Topic: Usernames containing square brackets

PunBB/FluxBB 1.3 allows registration with usernames which contain square [] brackets (i.e. "ridge[run]ner]"). This causes problems when quoting these users, because the parser does not properly handle QUOTE attributes that contain [square brackets] (and by default, the quoted username is always added to the quote attribute). The resulting post after the parser chokes on it is not pretty (the parser cuts off the quote attribute at the first right square bracket and places the rest of it in the main message. You can see these effects by manually inserting some [text] into a QUOTE attribute and see the results. This bug is probably not serious, just cosmetic (but all the ramifications have not been tested).

Recommended short term fix is to simply dis-allow new usernames containing square brackets. For current users that have brackets in their usernames (probably very few or none), there are several options: 1.) Do nothing (and tolerate the resulting minor consequences). 2.) Inform the users that they need to sign up with a new account and then delete the offending accounts, or 3.) modify the offending usernames to remove the brackets (which might have unforeseen consequences), and notify the users. Fixing the parser to properly handle tag attributes which contain square brackets is possible, but is probably not going to be easy.

Note that PunBB/FluxBB version 1.2 also alows registration with usernames that contain square brackets, but that version appears to properly handle quotes from these users.

Re: Usernames containing square brackets

Actually one can use in quotes usernames with square brackets.

[quote="username[with]brackets"]Hello![/quote]
username[with]brackets wrote:

Hello!

Re: Usernames containing square brackets

Yes, when the username is enclosed in double quotes, it appears to render correctly. But try it with either single quotes or no quotes, and you get the problem I described. For example:

[quote='username[with]brackets']Hello![/quote]

produces:

username[with]brackets wrote:

Hello!

and:

[quote=username[with]brackets]Hello![/quote]

produces:

username[with wrote:

brackets]Hello!

Re: Usernames containing square brackets

I know.

[quote=username[with]brackets]Hello![/quote]

It's an ambiguous code. One can think that the username is "username[with" and the text is "brackets]Hello!". And from the other hand, username can be "username[with]brackets" and the text can be "Hello!" You should use double quotes to avoid this ambiguity.