> it means 'End of string' in UTF-8 No it doesn't, unless you are saying that one should treat it like that. But null termination is as dangerous[1,2] with UTF

> it means 'End of string' in UTF-8 No it doesn't, unless you are saying that one should treat it like that. But null termination is as dangerous[1,2] with UTF-8 as it is with ASCII and should be avoided as much as possible anyway. Also, ASCII doesn't mandate that \0 is end-of-string, that's just a "convention" from C. (Did you notice that my original comment actually included the exact modified UTF-8 link you provided?) [1]: http://cwe.mitre.org/data/definitions/170.html http://cwe.mitre.org/data/definitions/170.html [2]: http://projects.webappsec.org/w/page/13246949/Null%20Byte%20Injection http://projects.webappsec.org/w/page/13246949/Null%20Byte%20...