Textarea validation

Question

I'm interested to hear what characters people permit in the various common fields of input forms (barring e-mail...)

For example:

Textarea/Messages: do you allow completely free text, or restrict to alphanumeric and punctuation? I've tried to go the second route, but you always find someone out there that likes using tilde's...

Full name: do you allow anything, or do you use a regex?

Telephone numbers: numbers only

Addresses: alphanumeric, whitespace, hyphens

City/Town names: alphabet, hyphens, whitespace

[NB: edited as requested]

Answer 1

no restrictions, provided that:

• the text is not published back to a web page in a way that would permit hijacking/hacking
• the text is not included in a SQL statement in a way that would make it vulnerable to sql injection
• you're reasonably sure that a person is responding and not a bot (captcha, for example)

Answer 2

I've worked at more than one place with these fields in portions of the software I needed to write. None of them had exactly the same answers.

It really depends on the needs of the people using the software..

Answer 3

I am generally very liberal in what I allow, especially for phone numbers. And if you allow for international phone numbers there are literally hundreds or even thousands of types.

For states I have a drop down list to select from but make sure it is international friendly.

For towns/city I often have a searchable list but allow them to override and enter their own. For street addresses I generally allow almost anything especially when loading from external data which is often full of rubbish addresses in an inconsistent format.