User names should be html encoded. In fact i would say that they should be restricted to a minimal set of characters. Yes this would take a smidgeon of the fun away but it would also mean that users wouldn't end up with untypable names, which would make things a lot easier in the CB and when replying.

Some examples:

chakka_&_the_pylons	chakka_&_the_pylons
Jeff	Jeff 
•	•
Halcyon&on	Halcyon&on
π	π
Halcyon&On&On	Halcyon&On&On
n21s&0s	n21s&0s
א	א

IMO, these are unacceptable user names (apologies to the users in question)

Update I did a test and tried to create a user named <script>window.alert("!");</script> which was dealt with somewhat alright, as the script tags were removed, so we are safe that way...
Sorry if this was an abuse by the way, it was in the best intentions. Anyway, i got the following error message (maybe this is a good thing??

Your new user account (window.alert("!");) has been created. 
You (---) should be getting an email soon telling you your generated p
+assword.
Server Error (Error Id 9654412)!
An error has occured. Please contact the site administrator with the E
+rror Id.
Thank you.
[download]

Yves / DeMerphq
--
When to use Prototypes?

So long as --&gt; is always around to immediately post right after &lt;!--, and so long as --&gt; doesn't mind never being heard, there shouldn't be a problem. Oh, we'll also have to be sure that there's always a --&gt; article rated just below every &lt;-- article. Expanding or contracting any lists to compensate.

Just kidding, of course...

Seriously, though, I've wondered the same kind of thing with some of the less-pronounceable user names around here.

For the most part, if someone wants to choose a name that's difficult to say/type/remember/read, that's fine with me. The more of them there are, the less distracting they are. But I agree that we should not allow ones that get in the way of the site.

I think HTML-encoding will do part of the trick, but don't know if there's a programmatic way to really solve this one, unless *all* input is HTML-encoded. Otherwise, someone could accidentally cause problems just by using another person's username in a post or chatterbox message.

I created --> thinking I could close the comment started by <!--, but it dawned on me after that the sorting on Newest Nodes would list --> before <!-- when it needs to be listed after (d'oh).

So instead, I've set up a "I've checked all of these" form on my home node that should update the appropriate timestamp to sometime after <!-- got here, so they no longer show up on Newest Nodes.

Update: Removed the form as the offending users have been deleted and fixes put in place.

    --k.

Well actually, it WILL BREAK the LAYOUT OF ANY SITE where its displayed on.
I just had a very strange view of newest nodes, where the sidebar nodelets where AFTER the content and not aside. And this is formerly unknown behaviuor to me. So Usernames and Nodetitles that screw up the sites design have to be disabled. Well for me it looks like portion poisoning code as it sometimes occures in open source projects. You bring in a bug in pieces. Once complete just use it - and if there is a way to break the server PM is running on ONE will DO it, just to show that he could.

Have a nice day
All decision is left to your taste

I submitted a patch to disallow < and > in usernames. There was already code to disallow [ and ].

Proper HTML-encoding of usernames will be a bit of a tough retrofit, BTW. I agree that there are several places where HTML- or URL-encoding of strings needs to be done but isn't (titles have several problems in this area).

Would something like this help?

my $whatever = param("WHATEVER"); # title, handle, whatever
if ($whatever =~ /[^a-zA-Z0-9_ /) {
  handle_failure("Sorry, but that contains unsupported characters.");
}
[download]

Just letters, underlines and spaces. No fuss, no screwups.

edited by footpad, ~Sat Feb 2 06:14:52 2002 (GMT): Fixed obvious syntax problems.