I am using UTF-8 for a new website, so I can do internationalisation on different pages, for example in greek (ελληνικά). I asked a question here earlier about possible security bugs this could bring and some people mentioned ones for example: "admin" (english alphabet) and "аdmin" (cyrillic "a") look absolutely the same however have different character codes and someone could register another account called "аdmin".
I am wondering what's the best way to completely filter out non-english alphabet characters. In the account information page I have a field for changing the username (for example, I don't actually), how would I go about removing them? Should I add a function checking with regex or something?
function changeUsername($newUsername)
{
if($this->isValidCharacters($newUsername) !== 1) {
send message saying invalid characters
}
continue changin username
}
And if so, what would the regex look like, still allowing all symbols but NO unicode characters or other alphabet characters?
Or is there an even easier way of blocking all input coming in from being UTF-8? For example changing the default charset in php.ini back to the default and simply sending a header changing the charset when I'm outputting in another language? And if they do send input with another alphabet and my server doesn't have the UTF-8 charset on how does my server interpretate it? Do I still need to do checks?
(As I said in my other post, I have no idea what I'm doing when it comes down to character sets.)