Graylog2/graylog2-web-interface — pull request #1006 by magicalbob (2014-12-13 12:39:35+00:00)
Title: Added validation to stop single quotes being included in username. 

Without this validation, a username including a single quote can't log in, and the user cannot be deleted.

The fact that the app doesn't handle single quotes in log in makes you think of SQL injection .....

I tried logging in with some dodgy usernames & password e.g. ' or '1'='1 but couldn't break in .... haven't looked at the code behind it though .....