Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

A follow-up to Enforcing a question minimum character length?, and an extension of Spaces getting past minimum character limit.

This post shows that it is possible to circumvent minimum character requirements using null bytes. Can we exclude such non-printing characters as ASCII NULL and other control characters from counting toward minimum character requirements?

Edit: Users have demonstrated that HTML comments, unmatched or invalid HTML tags, and other content that is not displayed after Markdown parsing can be used to bypass such requirements as well. Can we cover this case as well, except for links?

share|improve this question
There are other ways to get around it than using those characters. What does it solve? – animuson Jun 21 '12 at 0:22
IMO this is just trying way too hard for what is, at worst, an amusing oddity rather than a dangerous exploit. – Ben Brocka Jun 21 '12 at 1:15
Yeah, why do you want to prevent this... it's so much fun! – Alex Lockwood Jun 21 '12 at 1:17
Soft hyphen – Jason OOO Oct 10 '13 at 6:17
You should also not count the @username part towards the minimum characters in a case in which it will be stripped from the output. Like this case: If I type @DragonLordtheFiery at the beginning of this comment, it should not count toward the character minimum as it will be stripped from the output. – user215114 Oct 10 '13 at 15:47
up vote 7 down vote accepted

I'm not sure this is going to actually help anything. As users who can't reach the minimum character count have demonstrated, they'd rather find odd ways of avoiding the minimum limit that require more effort than just typing some extra text that supplements their answer.

Which of these would you rather see?





Yes. ____

If people really don't want to think up a simple 15 characters, there's nothing that's going to stop them. Most users who don't know about the null byte characters and the HTML comments just fill the space with random, meaningless characters such as sjfgshjfs to bypass the limit, or use other styles (headers, bold, italics) to make the text stand out when it doesn't need to stand out.

Personally, I'd much rather see the first one. It may be a character bypass, but at least it doesn't look stupid in general when you look at it. Ultimately answers which use these are probably not real answers anyways* and will end up deleted or get fixed by someone else.

* Unless you're on Meta.

share|improve this answer
You're right. I concede. :P – bwDraco Jun 21 '12 at 1:41


share|improve this answer
To this day, it's still possible to use null bytes to bypass minimum character requirements. – bwDraco Jun 21 '12 at 1:14
​​​​​​​​​​​​​​​ – bfavaretto Aug 31 '12 at 5:41
Well, null bytes have no place in text fields, so why should they be allowed? That's the point I'm trying to make. In fact, under certain circumstances, this can be a security vulnerability. This is another example of failing to sanitize input. – bwDraco Aug 31 '12 at 12:36
I haven't used null bytes, but the zero-width space character U+200B – bfavaretto Aug 31 '12 at 15:42
Okay, so they aren't null bytes. It turns out my hex editor didn't properly support Unicode... – bwDraco Aug 31 '12 at 22:35
Null bytes may work, but this is nothing new. Zero-width spaces, soft hyphens, zero-width non-joiners... there's no point in banning them all (that's what happened to the ZWNJ and it really didn't work). – Ryan O'Hara Aug 31 '12 at 22:40
share|improve this answer
How did you get yours to not even make space for the answer text, unlike the others? Or is it just rendering like that on my browser? – user215114 Oct 10 '13 at 15:49

share|improve this answer
I did it!!!! :D – Alex Lockwood Jun 21 '12 at 1:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .