Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have an employee whose last name is Null. He kills our employee lookup (2012)

stackoverflow.com

Post reply on HN
Print view View original

51–60 of 245 posts

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#51

Post by pmelendez »

speeder wrote: post #42
glimcat wrote: post #4

As long as we're playing the "Falsehoods Programmers Believe About Names" game again, here's the relevant patio11 article: http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b... If you try to validate names, or if you don't safely escape names along with your other user-input strings, you're gonna have a bad time.

My name fail to register surprisingly often, even here in Brazil. It is Hélder Maurício Gomes Ferreira Filho Common reasons for failure is being too long and having non ASCII characters, but sometimes it fails for other reasons, for example do not allow me to register without a middle name ( I don't haven't one actually... ), me confused and not knowing how to register Filho ( it is not a family name, neither a surna…

> "having non ASCII characters"

Accented vowels are ASCII characters but in the extended set which people sometimes don't take account.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#53

Post by patio11 »

A Japanese company once made the decision that they needed "virtual" employees in a particular system, for example to support e.g. adding a job to the org chart before that position had been filled (and another dozen use cases), so they had the clever idea "Hey, if we need to do this, we'll just input their 'name in Japanese' as one of a dozen status flags, like XX_JOB_REQUEST or XX_INCOMING_TRANSFER."

One developer at this company, who was annoyed with having to tweak a particular system every time they added a new possible status flag, wrote code which was, essentially:

  if (InternalStringUtils.isAllLatinCharacters(employee.getJapaneseName()) {
    /* no need to pay this 'employee' so remove them from batch 
    before we retrieve bank details for salary transfers */
    ...
  }
Do I have to explain why I'm aware of this curious implementation choice?

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#54

Post by sehrope »

glimcat wrote: post #4

As long as we're playing the "Falsehoods Programmers Believe About Names" game again, here's the relevant patio11 article: http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b... If you try to validate names, or if you don't safely escape names along with your other user-input strings, you're gonna have a bad time.

In our app we neither validate nor escape user strings for any free form text (eg. "names" and descriptions)[1]. We only validate the max length.

If text is truly free form then you don't need to validate or white list anything. Just make sure it's valid UTF-8 (or whatever encoding you're using) and escape it when you display it. That combined with using prepared statements with bind variables (aka named parameters) and you don't have any issues with user inputs.

One other benefit of this approach is that you end up with proper i18n support without doing anything special. From your apps perspective all text is the same. If user's want to use unicode characters or put html tags in their descriptions then let them. If you escape it then there's no XSS issue. Plus it's WYSIWYG[2] from a user's perspective.

Who am I to judge that a user putting "alert('Haxors!');" as the name of an object is a bad idea?

[1]: "Names" don't include usernames which generally should have a whitelisted character set (ex: ASCII [a-z][a-z0-9+]) or email addresses (use a a real validator ... not a regex!).

[2]: https://en.wikipedia.org/wiki/Wysiwyg

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#55

Post by speeder »

pmelendez wrote: post #51
speeder wrote: post #42

Earlier quoted context omitted.

My name fail to register surprisingly often, even here in Brazil. It is Hélder Maurício Gomes Ferreira Filho Common reasons for failure is being too long and having non ASCII characters, but sometimes it fails for other reasons, for example do not allow me to register without a middle name ( I don't haven't one actually... ), me confused and not knowing how to register Filho ( it is not a family name, neither a surna…

> "having non ASCII characters" Accented vowels are ASCII characters but in the extended set which people sometimes don't take account.

Or they account wrongly ;) (ie: from the wrong set)

I love how sometimes even on the same company, each place account ASCII differently.

I remember registering for a IM, and in one info screen my name was Maur&cio and in the site info screen Maur€cio and in the search screen was Maur£cio and so on...

Post reply on HN