I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters.

I have read this answer which describes how that might be achieved (by overriding the form validation for creating/editing a user).

My question is: Would there be some security risk in allowing special characters such as &/#?()+ in usernames, or did the Drupal developers make these characters illegal purely for aesthetic reasons?

2 Answers 2


I can think of three concerns when it comes to usernames and security: Cross Site Scripting (XSS), SQL Injection, and Homograph "attacks".

As long as you don't allow the < and > in usernames then you don't have to worry about XSS. If you want to allow one or both of those then you need to be more suspicious and do a thorough test of your site for XSS by entering a malicious username and seeing what happens.

SQL Injection should not be a problem. This has largely been solved in Drupal for a while and DBTNG in Drupal 7 makes it even less common. You could still test for it with some weird usernames that contain '; and other character combinations.

Homograph is then the worst thing. For a while (maybe still) you could register a username like Admin which looks a lot like Admin but in fact uses the MATHEMATICAL BOLD CAPITAL A from the list of confusables. The problem would arise from someone using a username that is a homographic match to a known "admin" on your site to register on the site and then using the contact or private message feature of the site (or even a public node/comment) to trick other users of the site into doing something stupid (e.g. posting a message "Our site is having login problems, please go to http://sitename.evil.example/password-reset and enter your credentials to have your login fixed."). By adding more characters to the allowed set of username characters you make a homograph social-engineering attack more likely/easier. I don't consider this to be a big problem and you should consider whether this is really a problem for your site before worrying about it.

The Real Name module is meant to give you this ability without the form alter. I don't think it's really any safer for homograph attacks, though.


Security? Not really, as all database communication is now wrapped in prepared statements. But they may break your URLs, as Drupal core is not really prepared to handle URL-unsafe usernames.

I suggest leave them be, and just add a field to a profile, call it "display name", and use it instead of username whenever you need a pretty name with URL-unsafe characters. It will be easier than changing default username handling.

  • 1
    Yes, I thought as much. Out of interest, when you mentioned the possibility of URLs breaking, were you thinking of any specific circumstances? I mean, the pathauto module will strip those special characters out of any URLs it generates and the views module will URL-encode special characters in its query strings when using exposed filters, so nothing should break there at least.
    – morbiD
    Commented Jan 9, 2014 at 12:51
  • @morbiD I remember having problems with it, but I honestly can't remember where exactly.
    – Mołot
    Commented Jan 9, 2014 at 12:55
  • @morbiD got it! Views and their filters and attributes - that's where I got screwed up by non-standard chars in usernames.
    – Mołot
    Commented Jan 10, 2014 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.