{"record":{"id":"53073b1af3308f44","repo":"flarum/framework","slug":"username-can-only-contain-letters-numbers-underscores-and","errorCode":null,"errorMessage":"Username can only contain letters, numbers, underscores, and dashes.","messagePattern":"Username can only contain letters, numbers, underscores, and dashes\\.","errorType":"validation","errorClass":"ValidationFailed","httpStatus":null,"severity":"error","filePath":"framework/core/src/Install/AdminUser.php","lineNumber":48,"sourceCode":"    public function getAttributes(): array\n    {\n        return [\n            'username' => $this->username,\n            'email' => $this->email,\n            'password' => (new BcryptHasher)->make($this->password),\n            'joined_at' => Carbon::now(),\n            'is_email_confirmed' => 1,\n        ];\n    }\n\n    private function validate(): void\n    {\n        if (! filter_var($this->email, FILTER_VALIDATE_EMAIL)) {\n            throw new ValidationFailed('You must enter a valid email.');\n        }\n\n        if (! $this->username || preg_match('/[^a-z0-9_-]/i', $this->username)) {\n            throw new ValidationFailed('Username can only contain letters, numbers, underscores, and dashes.');\n        }\n    }\n}\n","sourceCodeStart":30,"sourceCodeEnd":52,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Install/AdminUser.php#L30-L52","documentation":"AdminUser::validate() enforces that the admin username is non-empty and matches /^[a-z0-9_-]+$/i (letters, numbers, underscores, dashes only). Anything else — empty string, spaces, symbols, unicode — throws ValidationFailed during construction.","triggerScenarios":"Constructing AdminUser with '' or a username containing spaces or characters like '@', '.', '#', or accented letters.","commonSituations":"Users entering email-like usernames in the installer; copy-pasting names with spaces; localized usernames with non-ASCII characters.","solutions":["Enter a username using only A-Z, a-z, 0-9, '_' or '-'","Trim and sanitize the input before constructing AdminUser","Pre-validate with the same regex in the installer UI"],"exampleFix":"// before\nnew AdminUser('john doe!', $email, $password);\n// after\n$username = preg_replace('/[^a-z0-9_-]/i', '', $username);\nif ($username !== '') { new AdminUser($username, $email, $password); }","handlingStrategy":"validation","validationCode":"if ($username === '' || preg_match('/[^a-z0-9_-]/i', $username)) {\n    throw new ValidationFailed('Username can only contain letters, numbers, underscores, and dashes.');\n}","typeGuard":"function isValidUsername(?string $u): bool { return $u !== null && $u !== '' && preg_match('/^[a-z0-9_-]+$/i', $u) === 1; }","tryCatchPattern":"try {\n    $admin = new AdminUser($username, $email, $password);\n} catch (ValidationFailed $e) {\n    $form->addError('username', $e->getMessage());\n}","preventionTips":["Restrict username inputs with a pattern attribute matching [A-Za-z0-9_-]+","Sanitize/slugify usernames derived from display names before install","Avoid email-style or unicode usernames for admin accounts"],"tags":["validation","username","installation","admin-user"],"backgroundTag":"invalid-argument-format","analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}