Why a Username of "null" Breaks Your System and How to Prevent It

In many systems developers mistakenly treat the string "null" as an actual null value, which leads to subtle bugs when a user registers with the username "null".

Programmers' view of "null" is funny?

When code checks username == null it only catches true null references, not the literal string "null", so a user can submit JSON like {"username":"null","password":"123456"} and bypass validation.

if (username == null) {
    throw new IllegalArgumentException("Username cannot be null!");
}

The result is a registered user whose name is the string "null", causing confusing log messages such as Current user: null.

What problems does a username "null" cause?

User experience explosion: the welcome screen shows "Welcome, null!".

Log debugging hell: logs contain "null" and it is impossible to tell whether it is a real null or the string.

Database pollution: exports and deduplication reveal mysterious "null" entries.

Security risk: some systems treat "null" as a special identifier, opening XSS or information‑leakage vectors.

Automation script failures: scripts that skip null values miss the literal "null" and break business logic.

How to handle this issue?

(1) Strict username validation

private static final Set<String> ILLEGAL_USERNAMES = Set.of(
    "null", "undefined", " ", "\t", "
", "admin", "root"
);

public void validateUsername(String username) {
    if (username == null || ILLEGAL_USERNAMES.contains(username.trim().toLowerCase())) {
        throw new IllegalArgumentException("Invalid username!");
    }
}

(2) Front‑end interception

if (["null", "undefined", ""].includes(username.trim())) {
    alert("Username cannot be null or undefined!");
    return;
}

(3) Database constraint

ALTER TABLE users ADD CONSTRAINT chk_username
CHECK (username NOT IN ('null', 'undefined', ' '));

(4) Distinguish null in logs

logger.info("Username: {}", username == null ? "[NULL]" : username);

Final advice: don’t let users pay for your code

Validate at every entry point, enforce a unified naming rule, and adopt defensive programming so that unexpected values like "null" never reach production.