Question

We have a form that has fields for first and last name. I was asked to allow underscores. I don’t know of any sql injection that uses underscores, but I also don’t know of anyone with an underscore in their name. Is there a good reason to allow or not allow underscores in names?

EDIT: I’m using parameters and server side validation. This is for client side validation via the jQuery validation plugin.

EDIT 2: I didn’t mean for this to become a discussion on whether or not I should do any validation…I just wanted to know know if there was any compelling reason to accept underscores, like I should accept Irish people or hyphens. Based on that, I’m accepting Oren’s answer.

Answer 1

You should be as liberal as possible in what you allow as a name. There is no good reason to disallow an underscore, so why do it? There are many horror stories of people who try to utilize software that disallows their actual name. Have a look at Falsehoods Programmers Believe About Names for assumptions you should not make.