# User Titles with “special symbols” appear to be glitched

**URL:** https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287
**Category:** Bug
**Tags:** pr-welcome
**Created:** [May 26, 2023, 3:02am UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287 "2023-05-26T03:02:01Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![twofoursixeight](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/twofoursixeight/32/574822_2.png) [@twofoursixeight](https://meta.discourse.org/u/twofoursixeight)
#### Post date: [May 26, 2023, 3:02am UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/1 "2023-05-26T03:02:01Z")

</div>

![image](https://global.discourse-cdn.com/meta/original/4X/b/2/9/b293aeedd5fdb0378241f950f2959b78399c5ea9.jpeg)  
So if your title has a special symbol like ’ or ", then they will display weird stuff in the settings menu. It will be quite glitched.  
“The title should say Owner’s Pet.”

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [May 26, 2023, 4:11am UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/2 "2023-05-26T04:11:18Z")

</div>

Those would be smartquotes.

In which settings menu does it show like this?

The “glitchy” representations are the percent-encoded versions of those… possibly in the wrong codepage and not UTF-8?

Can you duplicate the problem here or on try?

---

<div class="post-metadata">

### Author: ![twofoursixeight](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/twofoursixeight/32/574822_2.png) [@twofoursixeight](https://meta.discourse.org/u/twofoursixeight)
#### Post date: [May 26, 2023, 4:13am UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/3 "2023-05-26T04:13:45Z")

</div>

> [@supermathie](#):
>
> In which settings menu does it show like this?

It shows up in Settings \>\> Preferences.

> [@supermathie](#):
>
> Can you duplicate the problem here or on try?

I don’t have any custom titles with smartquotes either. It cannot be tested on Try or Meta. Therefore it cannot be tested.

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [May 26, 2023, 4:15am UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/4 "2023-05-26T04:15:14Z")

</div>

Oh! _User_ titles. I was thinking topic titles.

> ![image](https://global.discourse-cdn.com/meta/original/4X/a/0/5/a05866724bc247ff1dd4e2b7dcd6ce1605a96473.png)

this is: `Person’s “title”`

@twofoursixeight can you copy the actual title string into a post here?

---

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [May 30, 2023, 4:18pm UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/5 "2023-05-30T16:18:48Z")

</div>

I can repro

 ![Screenshot 2023-05-30 at 12.10.28 PM](https://global.discourse-cdn.com/meta/original/4X/3/3/4/334ac3aa3bbc37264ff5a0e1ba52fe69ee3fa9c9.png)  
in this case it’s the apostrophe character, `'` (hex `&#x27;`)

Seems like other characters work properly, I tried a few others like `ˮ` or `«` and those were fine 🤷‍♂️

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 30, 2023, 11:30pm UTC](https://meta.discourse.org/t/user-titles-with-special-symbols-appear-to-be-glitched/266287/6 "2023-05-30T23:30:32Z")

</div>

This is going to be related to our security measures and ensuring there is no chance for script injection.

I am sure there is a straight forward fix, but surface area is quite big and we would need very careful testing to ensure that an XSS is not introduced with the fix.

Going to put #pr-welcome on this for now, but whoever takes this please be extra careful to prove your change does not introduce an XSS vector.