The username validation (line 482 of webloginpe.class.php) just checks for \ and \\, although bounces back a message that only alphanumeric characters are accepted. I came across this because I was wanting to make sure that tags or entities couldn’t sneak into the system.
Editing this to become:
if (!ctype_alnum($username)) // (TS)
{
return $this->FormatMessage($this->LanguageArray[32]);
}
makes the check match the message, and more relevantly, ensures tags and entities don’t creep in.
-- Tim.
