Question

A google search gave me the methods to validate form fields, but I can already construct them. My question is, which are the characters that are safe to include and which are to exclude in a form field? Specifically, username and password.

A brief explanation would be nice too.

Thanks.

Answer 1

You need to exclude all characters you will never have inside you datas.
Do you think it would be any sense to have special characters if your usernames/passwords must only contains alphanumeric characters ?

Look at some REGEX for JAVA or for PHP.

There is a regexp reference table which could be usefull too.

If you give us more information about the langage you are using, we could maybe help us more.
Have a good day!

[UPDATE]
There is the security reference which is very good and the OWASP website which is a real reference for any web security related topics, look at the OWASP Cheat Sheets.

#**Cross-Site Scripting Vulnerabilities?**
#for any programming language, the chars you should reject or handle properly are:
>     <   (     )     [     ]     '     "     ;     :     /     |

#for PHP, tools to handle with care:
strip_tags(), utf8_decode(), htmlspecialchars(), strtr()

#do Positive/Negative filtering
#check Encoding

#**SQL Injection ?**
#etc...

[/UPDATE]