eStream/eStreamChat — pull request #1 by ajbeaven (2013-12-13 10:32:06+00:00)
Title: Handle non-alphanumeric user ids

In messenger chat, when a user's id has a character that would cause an html attribute to be invalid, anyone chatting with that user will not be able to see any messages. This occurs because the userid is used to create the id for an element that needs to be retrieved to add messages inside.

This is a pretty hacky fix, so do with it what you will. Some non-alphanumeric characters are valid but I'm replacing all of them for simplicity's sake. Here's the HTML 4 specification for what id attributes are allowed:

> ID and NAME tokens must begin with a letter ([A-Za-z]) and may be followed by any number of letters, digits ([0-9]), hyphens ("-"), underscores ("_"), colons (":"), and periods (".").

HTML5 is more permissive than that, so yeah - simplicity wins.

Using this, there is potential that usernames could be duplicated (probably unlikely) or this code exploited. I would suggest not using the userid to create the id for the panel in the first place, and rather assign a auto generated id for the user when they connect to the chat, generating the id attribute based off that. That is, if assigning an id to this element is even necessary at all.