Member Avatar for patk570

Hi guys, I am looking to get a script that has all the variations of the name Admin/Administrator so customers/more advanced users cannot use those types of names. I am either looking to know if a mysql insert into code or a jquery/js code would be the best to use. I do not want any form of the word used.

How would you approach this?
What are your thoughts on this?

  • 2 Contributors
  • 2 Replies
  • 127 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by patk570

Dani AI

Generated

Short version: do a quick client-side check for UX (as suggested) but enforce the block on the server. The most reliable method is to canonicalize the submitted username (lowercase, transliterate Unicode, map common "leet" substitutions, strip punctuation) and then reject any username whose canonical form contains the sequence admin or administrator. That approach catches most deliberate obfuscations (adm1n, @dm!n, adm·in, etc.) without needing an impossible-to-maintain list of every permutation.

Practical steps:

  • Normalize: trim, lowercase, transliterate (strip accents / confusables), replace common substitutions (0->o, 1->i, @->a, $->s, !->i, etc.), remove non-alphanumerics.
  • Check: if normalized string contains admin or administrator, reject.
  • Persist: store a normalized username column (or regenerate it on each check) so DB-level checks/indices and duplicate checks are consistent.
  • Maintainability: keep a small database table of forbidden root-words (admin, administrator, root, sysadmin, webmaster) so adding more terms later is trivial.

Example server-side normalization + test (PHP):

function normalize_username($s) {
  $s = strtolower(trim($s));
  $s = iconv('UTF-8', 'ASCII//TRANSLIT', $s);
  $map = ['0'=>'o','1'=>'i','3'=>'e','4'=>'a','5'=>'s','7'=>'t','@'=>'a','$'=>'s','!'=>'i'];
  $s = str_replace(array_keys($map), array_values($map), $s);
  $s = preg_replace('/[^a-z0-9]/', '', $s);
  return $s;
}

$norm = normalize_username($_POST['username']);
if (strpos($norm, 'admin') !== false || strpos($norm, 'administrator') !== false) {
  // reject registration
}

Notes and cautions: test against false positives (some legitimate names may include the substring), keep the user-facing message generic for security, and prefer server-side logic or a DB trigger/check (if your MySQL version enforces CHECK or you use triggers) rather than relying only on client-side JS.

Recommended Answers

All 2 Replies

Member Avatar for JorgeM

You can do this with JavaScript or jQuery to check it client-side, but most importantly, you should also check server-side once the form is submitted because a user can bypass the JS/jQuery validation by disabling JS in their browser.

You can see an example of something that is related to what you are looking to do: http://jsfiddle.net/FVH5r/

Edited by JorgeM
Member Avatar for patk570

Hello,

My registration script already tests for same username, I am hoping to find something that someone already has made that I can insert that has all the admin variations in it. I know it doesnt doesn't really matter, as to what username they have but there is a blog that I created and dont dint want to have the users confused.

HAHA.

I know there is a huge list of variations of the name Admin/Administrator.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.