I'm building an app for a client, which they've requested to have a publicly-visible high score table. It'll be displaying their username, which is a free-text field that the players can input. Player count is likely to be extremely low - I’d expect 10s or 100s/day at most.

The username field will be longer than 3 characters. The names will be tied to Firebase Auth accounts, but these are created through the app, not tied to anything like Google Play or a Facebook account or anything like that. I think they’re going to be fine with deleting obviously offensive names, but they’re not going to have massive resources devoted to manual moderation.

When I was a young lad, 100% of my local arcade cabinet high score tables consisted of a bunch of swear words and offensive terms (or variations of such words).

I can't imagine the internet has improved matters at all.

How can I sanitise usernames to make them safe for display?

  • 10
    \$\begingroup\$ Does the client wish to sanitize usernames? If not then it's really not your issue as of right now. \$\endgroup\$
    – MonkeyZeus
    Oct 2, 2019 at 12:22
  • 5
    \$\begingroup\$ First thoughts: - Alert the client to this danger, ask if they want to spend money on your time to handle it. - Ask the client to give you a list of disallowed terms to scrub out. - Honestly, this is a minefield. Ask if they want it to be public at all. \$\endgroup\$
    – AJFaraday
    Oct 2, 2019 at 13:16
  • 4
    \$\begingroup\$ See also: the Scunthorp Problem. \$\endgroup\$ Oct 2, 2019 at 17:35
  • 4
    \$\begingroup\$ Not exactly the same thing, but similar enough: Obscenity Filters: Bad Idea, or Incredibly Intercoursing Bad Idea? \$\endgroup\$
    – Gary
    Oct 2, 2019 at 20:54
  • 3
    \$\begingroup\$ Are emoticon allowed? How will the score board be display? Can I ascii draw dong once I found way to input the score in your scoreboard? May I enter Url as name ("XYZ.com", "XYZ_Com", "XYZ_Dot_Com")? \$\endgroup\$ Oct 3, 2019 at 12:47

2 Answers 2


I recommend you just let the client do it manually.

From a cost perspective, you have luck on your side this time:

  • You expect no more than 100 users/day, possibly as low as 10/day
  • You have an authentication system, meaning bans can be permanent
  • You have a client that is happy to delete names (infrequently)

The reality is, the 10 minutes it will take for somebody to look over the top leaderboards and ban any extreme names - will simply be cheaper and more reliable, than you spending time on an engineering solution (which will have problems).

With such a low playercount, it's unlikely this would need done often - even once per week during peak is likely to be enough.

But I've got plenty of time, I can do something right?


You can very easily do something wrong, that is more damaging to the client's brand than doing nothing at all.

Want to use Regex to catch all the bad names? Better hope you get it perfectly right, and also filter all false-positives from multiple databases of international real-people names:


And even if you do manage the above successfully, players are not dumb - they will very easily find a way around your system to create an equally offensive name that you aren't catching.

At a minimum, you have just added even more work in keeping these rules updated, compared with the small manual work of just looking at the highest scores and banning.

No but seriously, this is a kids game - the client has made it clear there can be NO TOLERANCE for offensive names. There has to be something!

If this is honestly the case, and you cannot tolerate offensive names at all. The only realistic solution is just not to let your players create their own names.

This is the solution you'll find on almost all children's gaming websites, such as Cartoon Network.

Instead of giving a blank input, you give a selection of premade "name parts". For example:

  • An adjective, such as "Awesome", "Fantastic", "Cunning"

  • A middle, such as "Bearded", "Laser-eye", "Pirate"

  • A noun, such as "Master", "Winner", "Detector"

Which restricts display names to things like "Awesome Pirate Master".

Do also give a quick consideration of what wordlists you are using. There is no point implementing this system if the user is able to fiddle names to get things that still sound offensive or dirty.

Of course, there is the possibility for duplicates as well - but you can either write this off (3 lists of 100 words, already gives 1 million possible names) due to how few players you have, or if needed - you can still check that nobody else has the name on registration.

Realistically, this may be the most effective solution if you are seriously worried about bad names. But you do need to do a cost analysis, and find whether even making this system is really worth it compared to simple manual checks.

  • 25
    \$\begingroup\$ I like this answer, because "don't automate something until you know more about the problem" has almost always been the right thing to do in my experience. \$\endgroup\$
    – NeilD
    Oct 1, 2019 at 13:07
  • 5
    \$\begingroup\$ Reminds me of Lego universe and penis detection. \$\endgroup\$
    – n0rd
    Oct 2, 2019 at 1:07
  • 7
    \$\begingroup\$ A 4 year old had gotten access to one of my console game where you can create characters. That save slot was filled with poo, bum, pee, etc, etc. Kids do this, and laugh, a lot... \$\endgroup\$
    – Nelson
    Oct 2, 2019 at 2:54
  • 36
  • 4
    \$\begingroup\$ "But no, seriously, this is a kids game." Have you heard about Lego Universe? Not even Lego could build a penis detector. Name parts: "Cunning Linguist Pirate." \$\endgroup\$ Oct 2, 2019 at 17:38

A small user-base is probably not enough to detract from the ease of implementing a blacklist. There are many libraries and/or word-lists such as the ones referenced here that can allow you to simply check usernames against whatever you deem inappropriate.

If you decided to attempt your own list, you probably want to use regex to filter out names.

As Bilkokuya points out, there may be issues with legitimate names getting blacklisted. That is a business decision for your client to make, but one that you can/should make them aware of. I am not aware of any ways to get around the cultural aspect, except that if you are expecting a large number of users from cultures where that may be an issue, you may want to implement region-specific filtering.

Reasons to implement some form of filtering (in addition to manual checks):

  • Ease of implementation. Probably won't take more than an hour to get something going.

  • A deterrent to the less-dedicated pranksters.

  • Allows for checking at registration-time, lowering the chance that they will even reach the high score table.

  • Works with manual checks.

  • Seeing as it's an old problem, there should be many resources available.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .