Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm interested to hear what characters people permit in the various common fields of input forms (barring e-mail...)

For example:

Textarea/Messages: do you allow completely free text, or restrict to alphanumeric and punctuation? I've tried to go the second route, but you always find someone out there that likes using tilde's...

Full name: do you allow anything, or do you use a regex?

Telephone numbers: numbers only

Addresses: alphanumeric, whitespace, hyphens

City/Town names: alphabet, hyphens, whitespace

[NB: edited as requested]

share|improve this question
"contact forms" is a bit vague. Are you talking about Names? Address? Phone numbers? I'm going to have a completely different answer for each. Perhaps you could refine your question for us. – Walter Nov 28 '10 at 14:08
up vote 1 down vote accepted

no restrictions, provided that:

  • the text is not published back to a web page in a way that would permit hijacking/hacking
  • the text is not included in a SQL statement in a way that would make it vulnerable to sql injection
  • you're reasonably sure that a person is responding and not a bot (captcha, for example)
share|improve this answer

I've worked at more than one place with these fields in portions of the software I needed to write. None of them had exactly the same answers.

It really depends on the needs of the people using the software..

share|improve this answer

I am generally very liberal in what I allow, especially for phone numbers. And if you allow for international phone numbers there are literally hundreds or even thousands of types.

For states I have a drop down list to select from but make sure it is international friendly.

For towns/city I often have a searchable list but allow them to override and enter their own. For street addresses I generally allow almost anything especially when loading from external data which is often full of rubbish addresses in an inconsistent format.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.