When "null" Is Just a String: Hidden Bugs and How to Prevent Them

It starts with a humorous post where a user registers with the username "null". The code snippet shows a typical null check:

if (username == null) {
    throw new IllegalArgumentException("Username cannot be null!");
}

When the client sends JSON containing "username": "null", the check passes because the value is a non‑null string, so the registration succeeds and a ghost user named "null" appears in the database.

The log then prints "Current user: null", which looks like a real null value but is actually the literal string.

Problems caused by a literal "null" username

User‑experience explosion: After login the UI shows “Welcome, null!”, confusing the user.

Log‑debug hell: Logs are filled with the word null, making it impossible to distinguish real nulls from the string.

Database pollution: Exported data, permission tables, or deduplication scripts suddenly contain a row with username "null", appearing as dirty data.

Security risk: Some systems treat the string "null" as a special token, potentially leading to XSS or information leakage.

Automation script failure: Scripts that skip null values ignore the string "null", causing the ghost user to be missed and business logic to break.

How to fix it

(1) Strict server‑side validation

private static final Set<String> ILLEGAL_USERNAMES = Set.of(
    "null", "undefined", " ", "\t", "
", "admin", "root"
);
public void validateUsername(String username) {
    if (username == null || ILLEGAL_USERNAMES.contains(username.trim().toLowerCase())) {
        throw new IllegalArgumentException("Invalid username!");
    }
}

(2) Front‑end validation

if (["null", "undefined", ""].includes(username.trim())) {
    alert("Username cannot be null or undefined!");
    return;
}

(3) Database constraint

ALTER TABLE users
ADD CONSTRAINT chk_username
CHECK (username NOT IN ('null','undefined',' '));

(4) Distinguish real nulls in logs

logger.info("Username: {}", username == null ? "[NULL]" : username);

Final recommendations

Intercept at every entry point: registration, import, API calls.

Enforce a unified naming rule: only letters and numbers, length limits, no reserved words.

Adopt defensive programming: always assume users may input the most absurd values.

Source: Programmer Moon