Why Using "null" as a Username Can Crash Your System – Lessons and Fixes

Many developers mistakenly think the literal string "null" is the same as a null reference, but using it as a username can bypass null checks and cause real bugs.

Example code that checks for a null reference:

if (username == null) {
    throw new IllegalArgumentException("用户名不能为空！");
}

If a client submits {"username":"null","password":"123456"}, the check fails because the value is a non‑null string, allowing the user to register.

The string "null" is a valid value, so it can lead to:

User‑experience issues: the system greets the user with “Welcome, null!”.

Log‑debugging hell: logs contain “null” and it is hard to distinguish real nulls from the string.

Database contamination: “null” appears in exported data and duplicate‑user checks.

Security risks: some systems treat the string as a special token, opening XSS or information‑leak vectors.

Automation scripts that skip null values miss the “null” user and break business logic.

How to fix it:

(1) Strict username validation

private static final Set<String> ILLEGAL_USERNAMES = Set.of(
    "null", "undefined", " ", "\t", "
", "admin", "root"
);
public void validateUsername(String username) {
    if (username == null || ILLEGAL_USERNAMES.contains(username.trim().toLowerCase())) {
        throw new IllegalArgumentException("用户名非法！");
    }
}

(2) Front‑end validation

if (["null","undefined",""].includes(username.trim())) {
    alert("用户名不能是 null 或 undefined！");
    return;
}

(3) Database constraint

ALTER TABLE users ADD CONSTRAINT chk_username
CHECK (username NOT IN ('null','undefined',' '));

(4) Log distinction

logger.info("用户名为: {}", username == null ? "[NULL]" : username);

Final recommendations: intercept at every entry point, enforce a unified naming rule, and adopt defensive programming assuming users may input the most absurd values.

All programmers who have been trapped by “null”, you are not alone – next time you see the string, grab a coffee before the night‑long debugging begins.