What special characters to allow in name field?

[TechBoyJK]

Working on an app, and I'm wondering what special characters to allow and which ones to not allow. This is for the first name and last name.

Right now, I'm thinking i might only allow

.
-
,

Thoughts?

 

[JustAnAverageGuy]

[a-z][A-Z]

 

[degibson]

Assuming your character set is ASCII or extended ASCII.

Disallow characters to which the rest of your stack might be vulnerable.
SQL? Disallow \, ", ', ;, maybe others
Console? Disallow console formatting characters
vsprintf? Disallow %
etc.

There's basically no reason to allow any character under 20 (space), 155-159, or anything above 166. Some other characters sometimes make sense as inputs, but not in names (like 35, #).

 

[Leros]

Don't forget foreign languages and international users. Just make it UTF-8 and let them fill the name field with whatever they want.

 

[LokutusofBorg]

Encode it before you do anything with it and let them put whatever they want in there (within reason). No reason to prohibit Vanesa from putting umlauts over her a's, or the artist formerly known as Prince to put in an exotic ANSI character for his name. Unless there's a business reason for not allowing that... but I don't think that's why you're asking.

Protecting against harmful input isn't about not allowing certain characters in. You can't win that fight. Just encode *everything*.