What should be escaped? The username?

Test: I'm not sure how to write a test for that, because there are a couple of requirements for that.