I blew up a website registration/signup by using an underscore _ character in the last name field. Last name was required, but the UI accepted "_". Apparently, the backend sanitation cleared it out and the DB read/write code didn't validate against an empty value. 500 errors abound, but I can't re-register because that was successful.
Allow any characters in your name fields and think twice about requiring as much personal information.
Follow
But.. But.. What if we need that information later? We need to know everything about you, just in case!
Because you would never ever lie to us, would you?
Only if you address me as Robert'); DROP TABLE students;--
@jgg Haha, yah, someone said I should try registering to the same site as ol' Bobby :)
@jgg Please address me as "Mr. _"