Why Using “null” as a Username Breaks Your App and How to Prevent It

1. How developers view "null"

Example code shows a check for null that fails when the user submits the string "null". The registration succeeds because the string is considered a legal value, not a real null.

if (username == null) {
    throw new IllegalArgumentException("用户名不能为空！");
}

When the JSON payload contains "username": "null", the check does not trigger and the user is created.

The result is a ghost user named "null", causing confusing logs like 当前用户：null.

2. Problems caused by a "null" username

User experience explosion : After login the system greets “欢迎您，null！”, leaving the user bewildered.

Log debugging hell : Logs are filled with the word null, making it impossible to distinguish real null values from the string.

Database pollution : Exported data, permission management, and deduplication show a mysterious “null” record that is actually a legitimate user.

Security risk : Some systems treat the string "null" as a special marker, potentially leading to XSS or information leakage.

Automation scripts failure : Scripts that skip null values miss the “null” user, causing business logic errors.

3. How to fix it

(1) Strict username validation

private static final Set<String> ILLEGAL_USERNAMES = Set.of(
    "null", "undefined", " ", "\t", "
", "admin", "root"
);
public void validateUsername(String username) {
    if (username == null || ILLEGAL_USERNAMES.contains(username.trim().toLowerCase())) {
        throw new IllegalArgumentException("用户名非法！");
    }
}

(2) Front‑end interception

if (["null","undefined",""].includes(username.trim())) {
    alert("用户名不能是 null 或 undefined！");
    return;
}

(3) Database constraint

ALTER TABLE users
ADD CONSTRAINT chk_username
CHECK (username NOT IN ('null','undefined',' '));

(4) Distinguish null in logs

logger.info("用户名为: {}", username == null ? "[NULL]" : username);

4. Final advice

Intercept at every entry point: registration, import, API calls.

Enforce a unified naming rule: only letters and numbers, length limits.

Adopt defensive programming: always assume users will input the most bizarre values.