Member Avatar for DaveyMoyes

Hi everyone, I have a login form working great, until I found this strange error.
If a user enters the username as user name (with a space) the login script fails.
So I have tried using

$username = str_replace(' ', '', strtolower($username));

I thought the above would remove any spaces from the entered username and produce a single string.
It works when registering, but for some reason, it doesnt work on the login page.

Does anyone know why the above is not removing any spaces in the entered username.
Thanks
DM

  • 3 Contributors
  • 4 Replies
  • 302 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by vibhaJ

Dani AI

Generated

A few focused notes that clarify what likely caused the login mismatch and how to fix it cleanly, building on and 's suggestions.

Form input often contains more than the ASCII space character. Non‑breaking spaces, tabs, newlines, zero‑width or control characters, or different encodings can make a simple replace on ' ' appear to do nothing. Another common cause is that registration and login use different normalization steps: a username stored one way at signup will not match raw input at signin unless the same canonicalization is applied both times.

Quick debugging checklist

  • Log the raw bytes to see what is actually in the string (helps spot NBSP or invisible chars): 
    error_log('raw username: "' . $username . '" bytes=' . bin2hex($username));
  • Inspect the value before and after each transform (var_dump or error_log) to make sure the variable is not overwritten later.
  • Confirm the form field name and that POST/GET parsing is returning the expected value.

A robust normalization pipeline (run at registration and again on login)

  • Lowercase with multibyte support.
  • Apply Unicode normalization (if available) to collapse equivalent code points.
  • Strip all whitespace/control categories, not just ASCII space.
  • Restrict to the desired character classes (ASCII-only letters+digits, or Unicode letters+numbers).

Example approach (Unicode-aware):

if (extension_loaded('mbstring')) $username = mb_strtolower($username, 'UTF-8');
if (class_exists('Normalizer')) $username = Normalizer::normalize($username, Normalizer::FORM_KC);
$username = preg_replace('/[\p{Z}\p{C}]+/u', '', $username);   // remove all kinds of whitespace/control chars
$username = preg_replace('/[^\p{L}\p{N}]+/u', '', $username); // keep letters and numbers (Unicode-aware)

Other practical tips

  • Store a separate normalized_username column and query against it; add a unique index to prevent collisions.
  • Be careful: aggressive stripping can create collisions (e.g., "john.doe" -> "johndoe"); choose rules and communicate them at signup.
  • Continue using safe DB practices (prepared statements) and keep validation (like suggested) as the final step before accepting a username.

Recommended Answers

All 4 Replies

Member Avatar for veedeoo

try..

 $username = " this  is  user  name  ";
   $username = trim(str_replace(' ','',$username));
   echo $username;

for registration, try

  $username = preg_replace('/\s\s+/', '', $username);
Edited by veedeoo because: more info added
Member Avatar for DaveyMoyes

Hi, this worked a treat :) thanks,
Can I ask one more question about only allowing alphnumeric values.
I would like to restrict the usernames to only allow alphanumeric data, letters and numbers.

I have a number of lines of code like below

$sname = str_replace("'", '', strtolower($sname));
$sname = str_replace('-', '', strtolower($sname));

But there are many more characters I would like to dismiss from the users username.
How is this possible without having to create a seperate str_replace for each charachters

Member Avatar for veedeoo

try,

$user2 = " this / ?  is ~~ + | $ ##  * 7 ) user  name  <br/>";

    $user2 = preg_replace('/[^a-zA-Z0-9 ]/s', '', $user2);
    $user2 = trim(str_replace(' ','',$user2));

    echo "<br/>".$user2."<br/>";

Let the preg_replace to get process first, and then the trim string replace. They cannot be condensed I think.. I don't have the chance to test it.. Please let me know if the codes above worked..

Member Avatar for vibhaJ

PHP is having good function ctype_alnum, which will do all stuff for you in one line.

<?php
$username = 'testing123';
if(ctype_alnum($username))
{
    echo 'Username is valid';
}
else
{
    echo 'Username is not valid';
}
?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.