"Special characters not allowed" - and we eat only raw meat
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
Well, it stops those pesky SQL syntax errors without having to waste time learning about (and fixing) SQL injection. :rolleyes:
"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
Well, filenames can't have certain characters, so in some cases, telling the user that is okay, in my eyes.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013 -
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
IMHO, there shouldn't be any restrictions on length or composition of a password if they are using proper security. It looks like they are either storing passwords as clear-text, which is incredibly bad, or they are encrypting the passwords in the database, which is also bad. If they used salted hashes, like they should, none of it would matter.
if (Object.DividedByZero == true) { Universe.Implode(); } Meus ratio ex fortis machina. Simplicitatis de formae ac munus. -Foothill, 2016
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
-
Well, filenames can't have certain characters, so in some cases, telling the user that is okay, in my eyes.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013If you are naming a file, then it's understandable to check for those characters. But not in a username or password or plain text input field to be inserted into a file or database.
If you think 'goto' is evil, try writing an Assembly program without JMP.
-
IMHO, there shouldn't be any restrictions on length or composition of a password if they are using proper security. It looks like they are either storing passwords as clear-text, which is incredibly bad, or they are encrypting the passwords in the database, which is also bad. If they used salted hashes, like they should, none of it would matter.
if (Object.DividedByZero == true) { Universe.Implode(); } Meus ratio ex fortis machina. Simplicitatis de formae ac munus. -Foothill, 2016
Wait, what, he was writing a product review, nothing to do with passwords.
Never underestimate the power of human stupidity RAH
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
Maybe the developer had special needs... Anyway, what's so special about "special" characters? It's a phrase that's always got my back up. Is it just meant to be non-alphanumeric characters? These "special" characters are not so special when it comes to punctuation, etc!
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
Hey, it could be worse. I recently inherited a code base that won't even compile in release mode, only debug mode. And OFC it's using C's char type all over the place. Hey, the codebase is from 2016 mind you, so both Unicode and Unicode path names are a thing. And we're a German R&D office so umlauts are a thing as well. Ah, and the running code expects several support files RELATIVE TO THE WORKING DIRECTORY! In the meantime, I was able to toss that monstrosity. Do you want to guess what my successor did? He wrote a batch file to change to the proper folder and then launch the binary. Instead of fixing the source code to ignore the working directory. Ah, and this batch file bloody hell relies on an environmental variable to tell it where it lies itself. A part of this, I know for a fact, is to blame on both my predecessor's and my successor's deep hate for Windows and love for Linux (so they litereally couldn't give less of a damn how to makes things properly work on Windows), another part is simply "I don't want to learn anything new since I learned coding back in the 60s". And, I kid you not, this is but a slightly redacted quotation of the answer I received when trying to teach one of those guys ARC to pass a linked list between a part they're mainaining and the part that I was maintaining. And here we're back to where you started: Some people are just stuck in the 60s, or generally in the past. Learned coding back then, when 7-bit ASCII was the only way to go and simply couldn't care less about keeping up with the times. Even if keeping up with the tiems is but a matter of using ready constructs (like Unicode strings or c++'s list).
-
YouMeanYouWouldNotLetHimEvenUseSpacesQuestionMark
Software Zen:
delete this; -
YouMeanYouWouldNotLetHimEvenUseSpacesQuestionMark
Software Zen:
delete this; -
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
I have my own thoughts on this... Hold on a sec, I have a cold.... {cough, cough}Lazy Bastards{cough, cough} now where was I.... oh yes, well there we go :-)
-
Well, filenames can't have certain characters, so in some cases, telling the user that is okay, in my eyes.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013I used to have an Amiga 1000 which allowed filenames to have special characters and even non-printable characters. It worked great. That computer was way ahead of its competitors.
-
YOUARERIGHTIMISSEDTHATISTHISBETTERYOUMEANYOUWOULDNOTLETHIMEVENUSESPACESQUESTIONMARK
Software Zen:
delete this; -
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
It's easier to parse later with AI. (Take the lowest common denominator font; "alpha-numerics" only.) I think even Google at one time would stumble with "capitalized" versus "not".
"(I) am amazed to see myself here rather than there ... now rather than then". ― Blaise Pascal
-
When I get to see user prompts like that it really makes me feel someone's stuck on the stone age of web development. I'm not sure, I could be wrong. Do we still limit user from entering special characters? If yes, for what reason someone should be blocking these innocent characters? - * +, - & _ etc. I was painstakingly writing a product review in detail. At the end when I clicked on Submit button, it says "Please avoid using special characters". As if it's just a ignorable warning. It jus didn't let me submit till I removed the last quote symbol. How weird this is. I thought it's just about removing angle brackets (HTML Tags). But I had to remove even quotation marks,:, ; ,-, + , &,/,\ everything. Is there a sane reason behind this restriction? (I remember me restricting people entering "<>" tags in input box when I tried my very first classic Asp page :) )
Starting to think people post kid pics in their profiles because that was the last time they were cute - Jeremy Falcon.
1. Read this: https://www.owasp.org/index.php/XSS\_(Cross\_Site\_Scripting)\_Prevention\_Cheat\_Sheet 2. Ponder your own code that reflects user input data (like comments) back to a web page. 3. Realize that disallowing ALL special characters makes the data in the DB very future proof. Points to consider: 1. Assume any input is trying to hack you 2. Don't trust that the data in your DB is really safe if a user entered it originally. e.g., Today you emit from DB -> HTML and everything is safe. Tomorrow you emit from DB -> JSON and a lurking time bomb blows up in your face as all of your customers start mining bitcoin for someone (not you). P.S. Consider becoming a vegetarian
-
If you are naming a file, then it's understandable to check for those characters. But not in a username or password or plain text input field to be inserted into a file or database.
If you think 'goto' is evil, try writing an Assembly program without JMP.
Password raise a scary thought. If they're rejecting special characters in a password it implies they're writing it straight into the database as plain text without hashing it.
