Perhaps, but then do you still allow '-' for hyphenated names? Then, depending on the system and the query, '--' could still be problematic. Also terms like DROP, NULL, WHERE can still be constructed.
Proper query building and sanitization is the only reasonable solution.
Just today I was instructed by my bank to "use your full name". I have two middle names an the total length is 33 characters. The length limit was 20-something characters.
(the most annoying part is that I'd change it if I could because it has no value to me and is just a pain, but that my government doesn't allow it... :-/)
A someone with two middle names "only" totaling 19 characters I still run into issues with many forms, both online and offline.
I'm never quite sure what to do on offline forms that have boxes for characters that run out, I normally just continue writing past the boxes, but at least one official government documentation has been addressed to me just missing the second one.
And a few things seem to handle having multiple middle names (and thus middle initials) poorly, ignoring the length.
I only have one middle name but it’s the one I’ve gone by my whole life. At some point trying to deal with forms got old and so I started just putting my middle and last names down and claiming no middle name. Most places that demand your full legal name don’t actually care enough to check, banks included. It’s never caused me problems.
Mine gets munged with my first name and middle initial happening to form a different name anywhere where names get smashed together -- like plane tickets. Think 'ADRIAN A' vs 'ADRIANA'.
Same. My last name is 11 characters which is a little long but not that crazy, and my first and middle name are extremely common English names, and yet I can't often fit my full name in places that need it. Usually the issue is on paper forms (especially ones that have specific boxes for characters, which are usually the most important/official ones!), but it's also caused issues in various places on the web and in computer systems before.
Heh, I need to write a science fiction short where aliens find AI on Earth but all the humans are dead after an interpretation mistake caused because of a company named "DELETE HUMANS"
Or where humans accidentally read and alien QR code, we all die, but the QR just meant "drink your Ovaltine" or "We're trying to reach you about your car's extended warranty?"
In France, in 2004, a law was made to permit joining 2 family names together when parents want their child to have both last names, joined by not one, but two hyphens "--".
This lasted about 5 years before it was reversed. I met someone who had this in her last name and thought she was yanking my chain.
I'm so sorry my country did this.
Here is something in French that mentions the law, I couldn't easily find the original law online:
Hm, even doing SQL parameterization the wrong way (with dumb string joins), it shouldn't be an issue on its own. The real issue is names like O'Connell.
I know, the quotes must be there and will ignore anything inside, but with SQL misuse, you never know! Someone is probably using it in a worse way than any sane person would think possible.
Comments
Wouldn't it make more sense to create a whitelist of allowed characters (a-z, A-Z, 1-9, etc.)?
There is one! https://www.legislation.gov.uk/uksi/2015/17/schedule/1/made
It allows : / . < > and " though which is enough to allow XSS.
Strangely, though, they don't allow lower case letters.
And yes, you can register a company named > LIMITED and someone has https://find-and-update.company-information.service.gov.uk/c...
Hilariously they had first registered their name as "PREVIOUS COMPANY NAME LTD" and then changed the name to "> LIMITED" just for the joke.
Perhaps, but then do you still allow '-' for hyphenated names? Then, depending on the system and the query, '--' could still be problematic. Also terms like DROP, NULL, WHERE can still be constructed.
Proper query building and sanitization is the only reasonable solution.
My wife has a hyphen in her legal name. This is beyond the ability of most sites and companies to deal with and causes them to fail in random ways.
Just today I was instructed by my bank to "use your full name". I have two middle names an the total length is 33 characters. The length limit was 20-something characters.
(the most annoying part is that I'd change it if I could because it has no value to me and is just a pain, but that my government doesn't allow it... :-/)
A someone with two middle names "only" totaling 19 characters I still run into issues with many forms, both online and offline.
I'm never quite sure what to do on offline forms that have boxes for characters that run out, I normally just continue writing past the boxes, but at least one official government documentation has been addressed to me just missing the second one.
And a few things seem to handle having multiple middle names (and thus middle initials) poorly, ignoring the length.
I only have one middle name but it’s the one I’ve gone by my whole life. At some point trying to deal with forms got old and so I started just putting my middle and last names down and claiming no middle name. Most places that demand your full legal name don’t actually care enough to check, banks included. It’s never caused me problems.
In Hawaii, Mrs. Keihanaikukauakahihuliheekahaunaele can sympathize with you...
My name is often truncated
Mine gets munged with my first name and middle initial happening to form a different name anywhere where names get smashed together -- like plane tickets. Think 'ADRIAN A' vs 'ADRIANA'.
Same. My last name is 11 characters which is a little long but not that crazy, and my first and middle name are extremely common English names, and yet I can't often fit my full name in places that need it. Usually the issue is on paper forms (especially ones that have specific boxes for characters, which are usually the most important/official ones!), but it's also caused issues in various places on the web and in computer systems before.
We need you to capitalize that, Mr. Often Truncated.
I'm always thankful that my name has no hyphens, spaces, punctuation, or alternate spellings.
Heh, I need to write a science fiction short where aliens find AI on Earth but all the humans are dead after an interpretation mistake caused because of a company named "DELETE HUMANS"
Or where humans accidentally read and alien QR code, we all die, but the QR just meant "drink your Ovaltine" or "We're trying to reach you about your car's extended warranty?"
In France, in 2004, a law was made to permit joining 2 family names together when parents want their child to have both last names, joined by not one, but two hyphens "--".
This lasted about 5 years before it was reversed. I met someone who had this in her last name and thought she was yanking my chain.
I'm so sorry my country did this.
Here is something in French that mentions the law, I couldn't easily find the original law online:
https://www.senat.fr/questions/base/2011/qSEQ110418181.html
Now that I think about it, it's entirely possible that it caused some issues with SQL.
Hm, even doing SQL parameterization the wrong way (with dumb string joins), it shouldn't be an issue on its own. The real issue is names like O'Connell.
I know, the quotes must be there and will ignore anything inside, but with SQL misuse, you never know! Someone is probably using it in a worse way than any sane person would think possible.
That there looks like some of that "computer code" devil-speak!
Sorcery!