4 ms·
Wouldn't it make more sense to create a whitelist of allowed characters (a-z, A-Z, 1-9, etc.)?
by e2le 3y ago
Wouldn't it make more sense to create a whitelist of allowed characters (a-z, A-Z, 1-9, etc.)?
- firebat45 3y agoThat there looks like some of that "computer code" devil-speak!
- PlunderBunny 3y agoSorcery!
- kevindamm 3y agoPerhaps, but then do you still allow '-' for hyphenated names? Then, depending on the system and the query, '--' could still be problematic. Also terms like DROP, NULL, WHERE can still be constructed. Proper query building and sanitization is the only reasonable solution.
- pixl97 3y agoHeh, I need to write a science fiction short where aliens find AI on Earth but all the humans are dead after an interpretation mistake caused because of a company named "DELETE HUMANS"
- xen2xen1 3y agoOr where humans accidentally read and alien QR code, we all die, but the QR just meant "drink your Ovaltine" or "We're trying to reach you about your car's extended warranty?"
- not2b 3y agoMy wife has a hyphen in her legal name. This is beyond the ability of most sites and companies to deal with and causes them to fail in random ways.
- arp242 3y agoJust today I was instructed by my bank to "use your full name". I have two middle names an the total length is 33 characters. The length limit was 20-something characters. (the most annoying part is that I'd change it if I could because it has no value to me and is just a pain, but that my government doesn't allow it... :-/)
- chrisdhoover 3y agoMy name is often truncated
- eclipticplane 3y agoMine gets munged with my first name and middle initial happening to form a different name anywhere where names get smashed together -- like plane tickets. Think 'ADRIAN A' vs 'ADRIANA'.
- singlow 3y agoWe need you to capitalize that, Mr. Often Truncated.
- joemi 3y agoSame. My last name is 11 characters which is a little long but not that crazy, and my first and middle name are extremely common English names, and yet I can't often fit my full name in places that need it. Usually the issue is on paper forms (especially ones that have specific boxes for characters, which are usually the most important/official ones!), but it's also caused issues in various places on the web and in computer systems before.
- Vicinity9635 3y ago[dead]
- kimixa 3y agoA someone with two middle names "only" totaling 19 characters I still run into issues with many forms, both online and offline. I'm never quite sure what to do on offline forms that have boxes for characters that run out, I normally just continue writing past the boxes, but at least one official government documentation has been addressed to me just missing the second one. And a few things seem to handle having multiple middle names (and thus middle initials) poorly, ignoring the length.
- rpigab 3y agoIn France, in 2004, a law was made to permit joining 2 family names together when parents want their child to have both last names, joined by not one, but two hyphens "--". This lasted about 5 years before it was reversed. I met someone who had this in her last name and thought she was yanking my chain. I'm so sorry my country did this. Here is something in French that mentions the law, I couldn't easily find the original law online: https://www.senat.fr/questions/base/2011/qSEQ110418181.html https://www.senat.fr/questions/base/2011/qSEQ110418181.html Now that I think about it, it's entirely possible that it caused some issues with SQL.
- hot_gril 3y agoHm, even doing SQL parameterization the wrong way (with dumb string joins), it shouldn't be an issue on its own. The real issue is names like O'Connell.
- rpigab 3y agoI know, the quotes must be there and will ignore anything inside, but with SQL misuse, you never know! Someone is probably using it in a worse way than any sane person would think possible.
- michaelt 3y agoThere is one! https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made It allows : / . < > and " though which is enough to allow XSS. Strangely, though, they don't allow lower case letters. And yes, you can register a company named > LIMITED and someone has https://find-and-update.company-information.service.gov.uk/company/12852967 https://find-and-update.company-information.service.gov.uk/c...
- binarymax 3y agoHilariously they had first registered their name as "PREVIOUS COMPANY NAME LTD" and then changed the name to "> LIMITED" just for the joke.