> you match case-insensitive, but you always store the case the user entered in directly. You still need to normalize the unicode for either search or display,

> you match case-insensitive, but you always store the case the user entered in directly. You still need to normalize the unicode for either search or display, unless you're only allowing ascii or something. E.g. for the column you store for search and to guarantee uniqueness, casefold and then normalize to NFKC. And for the column you store for display, normalize to NFC. (And obviously you need to sanitize user input before doing anything.)