I'm working on the onboarding of my web app and I'm wondering how to sanitize user input for data fields such as the name or the business name. Initially I limited input to only letters and numbers but realized it doesn't work for O'Malley with the quote, évoù with accents, and KLA-Tencore with the hyphen. What's a good limitation of inputs for sanitized user data?



Be careful of using methods that would prevent some of your users from entering their actual names. Names are extremely personal and being told 'you can't use your real name' isn't going to sit well with everyone. I remember dealing with a customer at least once a month who was upset that she couldn't use her hyphenated name (this was a rarely-accessed system where your password was mandated to be your last name — not mine, don't ask). She didn't understand why she couldn't use it and didn't like the explanation. There's been some pretty high-profile backlash over this, such as Facebook's spat with Irish users who were told to 'use a real name'.

PixelSnader is correct that the answer will depend on what you're having your user fill out. Your technology is the other side of that equation. For example, PHP apparently doesn't like file names with 'weird characters'.

My opinion though, you should make every effort to accommodate special characters in places where you can. If you must sanitise special characters you should make every effort to make that transparent to the user.

As for methodologies, given Facebook's allowance I'd be curious to see how they're doing it but one potential option for certain fields may be to encode the input and decode it when needed. OWASP has some suggestions on data validation strategies including a Base64 encode.

| improve this answer | |

Sanitizing user input doesn't imply you change or restrict input, it simply means you handle it safely and escape it when necessary to prevent exploits like XSS attacks. If you're saving the data to a database, use parameterized queries. Even if your specific database doesn't support them directly, often times many libraries can add a simple wrapper over them to allow you to essentially do the same thing. If you're outputting to an HTML page, escape it for HTML, etc.

tl;dr Never change a user's data; simply use it safely.

| improve this answer | |

how to sanitize user input for data fields such as the name


  • Don't. If you are worried about SQL injection, use parameterised queries instead.

  • Use appropriate Unicode character classes. For example see Java regex for support Unicode?: \p{L}+.

| improve this answer | |

Look in to commonly used allowed formats and symbols for text input. For example, email allows A-Z, a-z, 1-0 and !#$%&'*+-/=?^_`{|}~. Domain names on the other hand only allow A-Z, a-z, 1-0 and hyphens.

There isn't a simple end-all solution for user input. It's highly dependent on context. What are they filling in, how are they filling it in, where are they from etc.

If it's a login or url/pagename, I'd stay far away from uncommon symbols. How do you type "é" on a phone? So I'd suggest just letters (allow capitals but don't make them count) and one, maybe two separators. If a company is called O'Malley's Hardware and Tools, they could use O-Malleys-Hardware-And-Tools (Or a more sensible O-Malleys).

However if it's a field for display purposes then you can allow more. Potentially all unicode characters, even though that brings a host of other issues such as missing symbols in the font or whatever. Technically it won't do harm, but while O´Malleys using a specific mark might be optimal, but O'Malleys or O-Malleys may be preferred over O󴈿Malleys.

In the end, it depends on the use case. You've not given us enough to go on, but even if you did, it's a pretty individual choice. Stability versus freedom of expression.

| improve this answer | |
  • 4
    "How do you type "é" on a phone?" - Probably as easily as you type "3" on yours. Several billion people can probably type 李四 on their phone as easily as you or I type "john smith". It is the 21st century not 1963. Any software that isn't antideluvian should be able to cope with people's real names. – RedGrittyBrick Jun 8 '16 at 13:57
  • @RedGrittyBrick I type a 3 on my phone with 1 button. Even on a PC a single button press won't get you all of the latin-esque accented characters. – PixelSnader Jun 8 '16 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.