Allow non-ASCII usernames

[marshosh]

WordPress currently transforms usernames and potential usernames into a restricted set of ASCII characters. It attempts to remove HTML, diacritics, and transform other characters to ASCII equivalents, stripping away anything that remains.

This prevents storing usernames that correspond to someone’s name or chosen identify, if that name falls outside the restricted range. For example, the username 北斎 is unusable because sanitize_user( '北斎', true ) returns the empty string.

WordPress should relax its restrictions on usernames to be more inclusive and permit locale-specific sites and users to express themselves as they are, not having to make concessions for latin-based technology.

Complications

• Not all restrictions should be removed, but it would be important to double-down on the original intent of those filters; notably, to limit confusable characters such as non-printable and non-visible characters. Unicode defines considerably more complicated text rules, so an update to the system should improve the Unicode compliance surrounding these issues.
• Given the higher probability of multiple representations for non-ASCII usernames, it would be important to normalize all inputs using an appriate algorithm, such as NKFD.
• Existing code and plugins are going to assume ASCII-only usernames and unlocking more complete naming should not introduce any more backwards compatibility breaks than are absolutely necessary.
• Some installations will be running on non-UTF-8 database tables which cannot represent all possible Unicode-based usernames. For these installations, it must be clear that extended username support is unavailable.
• Any changes to URL routing need to maintain redirects to the legacy ASCII-based structure to prevent breaking existing integrations which assume the fixed patterns; for example, /author/dmsnell should redirect to /autor/dmsnell on a German site…

Help

Unicode provides ample guidance here which can help WordPress to:

• avoid known security issues
• implement these behaviors in harmony with expectations from other software
• how to best display these characters in interfaces

Warnings

• ​Unicode Security FAQ and ​Security Considerations Technical Report
• ​Spotify shared about some security issues with Unicode usernames.

Related

• #62948 Non-ASCII slugs need comprehensive transformation and inspection as well.

[Denis-de-Bernardy]

related: #9591

[Denis-de-Bernardy]

possibly related: #5472

[dwright]

Here is a patch that will enable a user to register with an arabic name.

(however, it also probably introduces security issues)

[dwright]

dont enforce strict on registration names patch, against revision 12187

[dwright]

register user with arabic name

[dwright]

arabic user login

[dwright]

admin area (simple)

[dwright]

edit arabic user

[ryan]

Something to consider for 3.0 after considering all security ramifications.

[dd32]

Moving to 3.1, As ryan said, We need to consider any of the security ramifications of this change. We're nearing beta right now, it doesn't seem appropriate to change this late in the game.

[mamouneyya]

Please consider implementing this in 3.2. Registration always confuses my users because they cannot use non-ASCII characters.

[dd32]

Please leave the version field set to when it was originally reported.

[mamouneyya]

Sorry, I was just trying to say that the same issue still exists in the latest version.

[cupid4]

I think this is really a must-have feature for WordPress, from my experience, trying to create Arabic website with WordPress, it made a lot of confusion to users cause they simply tried to make Arabic names and every time it tell them the name is wrong and never mentioned anything about language, not even a warning or a comment to say the name should be in English, so it took me a while and losing a lot of users too before I figured out that WordPress doesn't support Arabic names at all.

It's really needed fix for WordPress localization, there is no point of creating Arabic website if your users can't choose their name in Arabic :) I hope this is being considered for 3.3

[dd32]

Version changed from 2.3.3 to 3.3

The version field is used to track when a issue was first raised, This need not be updated to a current release upon commenting. Any version between the "Version" and "Milestone" field is considered to be affected

[cupid4]

Replying to dd32:

Version changed from 2.3.3 to 3.3

The version field is used to track when a issue was first raised, This need not be updated to a current release upon commenting. Any version between the "Version" and "Milestone" field is considered to be affected

Okay, didn't mean to mess with anything, I just thought it's the right way to promote the ticket to the version. well, any comments about the ticket subject itself?

[SergeyBiryukov]

#18666 has a workaround plugin to allow Arabic usernames.

[bpetty]

Username values related: #17793, #16833

Also, this does not appear to actually be a bug, more of a feature request / enhancement.

WP might not have been clear in the past, and may have allowed more, but there is a specific set of valid characters for usernames, and it doesn't even include the full ASCII range now. See #17793 for a patch currently open to make valid characters more clear in user creation error messages.

I think it's safe to say at this point that the username values will never support any characters outside of it's current range of characters.

[alex-ye]

As the WordPress is a global script , non-ascii user names should be supported in the core , This ticket was opening before 5 years !

[alex-ye]

The problem is still exists in WordPress 3.5

[SergeyBiryukov]

Version number indicates when the enhancement was initially suggested. See comment:13.

[alex-ye]

Replying to SergeyBiryukov:

Version number indicates when the enhancement was initially suggested. See comment:13.

:) , Thank you for explaining .

[SergeyBiryukov]

#23238 was marked as a duplicate.

[iseulde]

Is this possible considering that usernames are used in urls like author pages? It's also worth noting that plugins might rely on the fact that the username is alphanumeric (e.g. P2's @mentions).

This is related to allowing non-ASCII post slugs and IDN support (see #10690 and #10298).

[SergeyBiryukov]

#24939 was marked as a duplicate.

[Clorith]

#38325 was marked as a duplicate.

[Clorith]

#38325 was marked as a duplicate.

[macmanx]

#38325 was marked as a duplicate.

[macmanx]

#38325 was marked as a duplicate.

[sachinrajcp123]

Enhancement: Allow non-ASCII usernames by updating sanitize_user() to support Unicode letters.

[dmsnell]

#64996 was marked as a duplicate.

[dmsnell]

@marshosh I hope it’s okay, but I expanded the Ticket’s description to try and convey more of the scale of the issue. Thanks for bringing this up.

Trac ticket: Core-5918

## Status

WIP

Props dmsnell, tusharbharti, SirLouen, Mukesh Panchal.