No it shouldn’t. Text field entry should have two properties: (1) accept any UTF-8 string, (2) do not modify that string.
If you want to make sure people don’t make mistakes, take all your current validation code and turn it into a huge red warning that pops up if you try to continue with an “incorrect” field, asking you to double-check before proceeding. In the OP case it would be “You have entered an uncommon name”, in case of extra whitespace it would be “There is whitespace after the name”. Let the person themselves edit the field, don’t change the text automatically at all.
If those fields are used for anything other than interacting with the person entering them, validate during submission. In this case, charge a $1 HOLD on the credit card using the info provided.
Anything other than that will lead to someone somewhere having an issue like the OP.
No, you should definitely sanitize the names if you are going to display them anywhere. You don’t need JS to execute just because it’s in someone’s name, and that would also cause it to display incorrectly as the JS portion would not be shown. Getting rid of excess whitespace is fine aswell as it does not change the name
That’s just awful security practices. You must not replace proper code/data separation with user input sanitization. If you are just pulling names from a database and inserting them into your DOM directly you’re doing things majorly wrong and half your codebase probably needs rewriting from scratch.
If your stack does not support code/data separation, you should escape at the point of use/point of interface with other software, not at the point of user data entry.
You should not “sanitize” something as personal as a name. It is up to the individual to identify themselves as they see fit, whether it is some weird legal name or just how they want to present. For every “rule” about names you can think of, there will be an exception somewhere.
In fact, even splitting up the name field into “first name” and “last name” is already wrong. It should just be “name”. If you need there to be a separate “first name” and “last name” for some reason (e.g. an external system which requires it), allow leaving either one as empty. Bonus points if you have independent “legal name” and “how would you like to be called” fields.
Getting rid of excess whitespace is fine aswell as it does not change the name
As a responsible developer you must not assume this. Especially if your software interacts with other systems. You never know what dumb shit some other system has got up to, maybe a clerk somewhere accidentally entered someone’s name with a space and that person desperately needs to use your software while they’re getting things fixed.
As an immigrant, I have been personally strongly inconvenienced by user input validation very often. For example, a tax agency system (which has my passport number recorded with a space) rejected automatic declarations from my bank (where the system did not allow spaces in the passport number) so I had to fill my tax declarations manually for a while. Or my bank rejecting bills from the water utility because the utility’s system required entering two surnames, and I only have one, so they just put it in there twice. The amount of services which reject my pretty normal-looking self-hosted email address with “enter a valid email address” (presumably it must end in @gmail.com or @outlook.com) is staggering. This kind of bullshit is widespread and it needs to stop. You as a developer don’t know better than the person entering the data about themselves.
So many places do these things wrong and just make wild assumptions based on their limited PoV.
I just spent a month adding international phone, name, and postal code support to a legacy app at my job.
They weren’t even consistent with their enforcement inside of the app.
Don’t add validation for anything unless you understand 100% of the cases. You should use premade libraries or tools in most cases because you will do it incorrectly.
No it shouldn’t. Text field entry should have two properties: (1) accept any UTF-8 string, (2) do not modify that string.
If you want to make sure people don’t make mistakes, take all your current validation code and turn it into a huge red warning that pops up if you try to continue with an “incorrect” field, asking you to double-check before proceeding. In the OP case it would be “You have entered an uncommon name”, in case of extra whitespace it would be “There is whitespace after the name”. Let the person themselves edit the field, don’t change the text automatically at all.
If those fields are used for anything other than interacting with the person entering them, validate during submission. In this case, charge a $1 HOLD on the credit card using the info provided.
Anything other than that will lead to someone somewhere having an issue like the OP.
No, you should definitely sanitize the names if you are going to display them anywhere. You don’t need JS to execute just because it’s in someone’s name, and that would also cause it to display incorrectly as the JS portion would not be shown. Getting rid of excess whitespace is fine aswell as it does not change the name
That’s just awful security practices. You must not replace proper code/data separation with user input sanitization. If you are just pulling names from a database and inserting them into your DOM directly you’re doing things majorly wrong and half your codebase probably needs rewriting from scratch.
If your stack does not support code/data separation, you should escape at the point of use/point of interface with other software, not at the point of user data entry.
You should not “sanitize” something as personal as a name. It is up to the individual to identify themselves as they see fit, whether it is some weird legal name or just how they want to present. For every “rule” about names you can think of, there will be an exception somewhere.
In fact, even splitting up the name field into “first name” and “last name” is already wrong. It should just be “name”. If you need there to be a separate “first name” and “last name” for some reason (e.g. an external system which requires it), allow leaving either one as empty. Bonus points if you have independent “legal name” and “how would you like to be called” fields.
As a responsible developer you must not assume this. Especially if your software interacts with other systems. You never know what dumb shit some other system has got up to, maybe a clerk somewhere accidentally entered someone’s name with a space and that person desperately needs to use your software while they’re getting things fixed.
As an immigrant, I have been personally strongly inconvenienced by user input validation very often. For example, a tax agency system (which has my passport number recorded with a space) rejected automatic declarations from my bank (where the system did not allow spaces in the passport number) so I had to fill my tax declarations manually for a while. Or my bank rejecting bills from the water utility because the utility’s system required entering two surnames, and I only have one, so they just put it in there twice. The amount of services which reject my pretty normal-looking self-hosted email address with “enter a valid email address” (presumably it must end in
@gmail.comor@outlook.com) is staggering. This kind of bullshit is widespread and it needs to stop. You as a developer don’t know better than the person entering the data about themselves.100% this.
So many places do these things wrong and just make wild assumptions based on their limited PoV.
I just spent a month adding international phone, name, and postal code support to a legacy app at my job.
They weren’t even consistent with their enforcement inside of the app.
Don’t add validation for anything unless you understand 100% of the cases. You should use premade libraries or tools in most cases because you will do it incorrectly.
The rules around passwords are equally as dumb