Using the single apostophy in username

New Member Joined: Aug 24, 2006 Posts: 21

Hi All

Does anyone, who knows the details of PHP Nuke coding, know of any problem using the single appostophy in a username. Firstly, I don't think it's possible with the default character limitations and secondly, if able to include as a usable character, will it conflict with coding?

Any ideas?

Regards,

JC

Posted: Thu Sep 21, 2006 6:14 pm

You can add the single quote to the allowed characters that the username will accept, however I don't know if the rest of the system is designed to use it. Try it and see

Posted: Thu Sep 21, 2006 7:11 pm

Good question. I just tried it on a test 2.02 system I have. I could create username jone's okay. But when I logged in what I wound up with was:

"Welcome jone\\\\\\\'s!"

up on the top line of the fisubice theme.

I don't think I'd experiment further with this unless there is some overriding reason to have the ' in there. Incidentally, same behavior on a RN 2.10 system I'm testing. I'd just stay away from this unless I were masochistic.

Posted: Thu Sep 21, 2006 9:20 pm

Mmm must be an addslashes thing. I bet it is used redundantly on the username name

Posted: Fri Sep 22, 2006 10:54 am

Hi fkelly

That's why I asked. Because I didn't know if you could login with normal username including the ' or if you have to login using the parsed ////' version of the username. I will keep clear of this.

How about # and .

I don't see major problem here but I'm not the guru.

Cheers,

JC

Posted: Fri Sep 22, 2006 11:03 am

Theoretically the code should be able to handle special characters. But I think its just disallowed as not to cause problems

Posted: Fri Sep 22, 2006 12:05 pm

As to addslashes ... it doesn't appear to be used at all. The name that's stored in the database is jone's. That's Joneapostrophes. I'd think that with addslashes it would be stored as Jone\'s. ? Haven't tested that. Then stripslashes would return Jone's.

I haven't had a chance to look at your account.php yet but I bet they never anticipated that usage. Still the code should be there in case.

Why it is returned as jone\\\\\\\'s is beyond me. Perhaps to exemplify garbage in garbage out.