I don't know if it was premeditated or some sort of fluke involving sunspots and cosmic rays, but a humorous hats off to PokerStars player ROBCASHFLOW, whoever you are, for successfully embedding an illegal, invisible, non-printing ASCII control character (specifically, the unit separator, decimal value 31, hex 0x1F) between the third and fourth letters of your online poker username...

ROBCASHFLOW

...making life just a little more difficult for anybody who wants to search for your name, or type it into a search box, or copy and paste it into something, store it in a database, upload it to a website, etc. Essentially, this handle is a complete PITA! : ) So today we salute you, Mr. Embedding Problematic Phantom Characters into His Online User Name Guy, in recognition of that fact.

But I don't see any phantom characters.



Right. Because they're phantom. They're invisible. To "see" these characters, you have to use a trick like this one (or crack open a hex editor):

Select the above user name (ROBCASHFLOW) with your mouse, then let go of the mouse. Press and hold the SHIFT key on your keyboard. While holding the SHIFT key, use the Left and Right arrow keys to move the trailing edge of the selection back and forth across the gap between the "B" and the "C".

You'll notice it takes two keypresses to navigate from the position just before the "C" to the position just after, where it should only take one. That's because one of those keypresses is consumed by that innocuous ASCII 31.

Okay, but that's just a glitch. It doesn't happen consistently.



It happens anywhere the player name "ROBCASHFLOW" appears, on any website, in any document, in any application window, across pretty much the entire world of computing. The embedded "phantom" character is a formal part of the player name even though we can't see it, so it gets dumped to the hand history file, uploaded to the website, copied-and-pasted into the text document, downloaded to your iPhone, and so forth and so on. Forever.

Take a look at the following telltale bug report (now resolved) from the Hold'em Manager forums. The culprit? The rascal, ROBCASHFLOW, in Seat 3, with his embedded phantom character.

Hi I just got some import errors for the first time today.

I am using version 1.06.03H

here is a hand. Thanks for the help.



PokerStars Game #XXXXXXXXXXX: Hold'em No Limit ($0.25/$0.50) - 200X/11/25 23:43:50 ET Table 'Apus II' 6-max Seat #3 is the button

Seat 1: KGould035 ($9.70 in chips)

Seat 2: RHFiend ($50 in chips)

Seat 3: ROBCASHFLOW ($87.55 in chips)

When I first stumbled across this (well, actually, I ran into the problem because I happen to have a hand history against this guy, which was causing an obscure error condition in my poker setup, which compelled me to start Googling, at which point I found the HEM bug report and started to piece together the ROBCASHFLOW puzzle) I thought to myself:

Huh. Probably a fluke.

So I did some more searching and I discovered ROBCASHFLOW is also mentioned here, here, here, and here. And everywhere his name appears (with no exceptions), there you'll find an invisible phantom character embedded.

This doesn't just happen on websites; that phantom ASCII 31 is also preserved on the desktop, in the PokerStars client, not to mention Hold'em Manager, PokerTracker, PostgreSQL, Notepad, Word, Excel, and, in general, anywhere you can get a caret or selection to move through ROBCASHFLOW's official name, it will stutter between the "B" and the "C". And that's not a bug: that's correct behavior, provided you've accepted the fact that obnoxious nonprintable characters can appear in player handles.

(Which by the way, is a big WTF unto itself.)

So yes, I'd say it happens consistently.

The Search-Resistant Handle



The upshot of all this is that ROBCASHFLOW's handle is effectively hardened against casual searches. Just try surfing over to Sharkscope.com and doing a search for ROBCASHFLOW. One of two things will happen:

If you TYPE his name into the search box, omitting the phantom character, you won't find him. The search returns 0 results, as it should. There is no player called ROBCASHFLOW, without the embedded phantom. There is a player called ROBCASHFLOW, however. With the phantom.

If you COPY AND PASTE his name, you won't even be able to get his name into the Search box. It will truncate everything occurring after the phantom character, leaving you with "ROB".

[Update: Sharkscope appears to have changed/updated their behavior this morning. This player is now searchable through the below link as well as through copy-and-paste into the search box.]

And before you start thinking that maybe this guy doesn't have a Sharkscope profile, let me just point out that he's listed on the Sharkscope list of player names starting with "ROB", where his name has a valid hyperlink to his profile page, which is:

http://www.sharkscope.com/?username=ROB%1FCASHFLOW&network=pokerstars

But good luck pulling up that page in a web browser. Go ahead and give it a shot. You'll end up back at the truncated "ROB" screen.

You see, not only can you not search for ROBCASHFLOW; you can't even get his name to fit inside the search box. Not without working at it. The phrase ROBCASHFLOW is like kryptonite for search.

[Update: Sharkscope appears to have changed/updated their behavior this morning. This player is now searchable again.]

How To Invalidate Your Player Notes File

Nowadays the top poker sites (Full Tilt and PokerStars) both use an open XML format for storing player notes. This is a big feature, often overlooked, which I hope spreads to other sites in due course. But XML has some peculiarities, not least of which is this:

Certain characters are illegal and may not appear in a valid, well-formed XML document

You can check out the nightmarish W3C XML spec for the official rundown, but I'll go ahead and tell you: ASCII 31, the problem character in ROBCASHFLOW's name, is an illegal XML character.

ASCII 32, the next character up, is legit; that's a plain vanilla space character. But ASCII 31 is illegal XML. Any XML document that contains an unencoded ASCII 31 is an invalid XML document, by definition. And since player notes files are XML documents, on PokerStars anyway, that means that taking a note on ROBCASHFLOW silently invalidates your XML notes file.

That doesn't mean that you lose your player notes file, or that your player notes get corrupted, or that PokerStars refuses to load them. None of that happens. Don't worry about it. (Especially since you routinely backup your player notes files, right?)

It just means that your XML file is now technically invalid, and if you ever try to load it or edit it with another tool, there's a good chance you'll get one of these.

As would happen if you tried to use (just as one common example) the .NET XmlReader class to read one of these hypothetical invalidated player notes files. That's a validating reader and it doesn't play games with invalid XML characters. It blows up, and no, XmlReaderSettings.CheckCharacters doesn't help. As the documentation states:

If the XmlReader is processing text data, it always checks that the XML names and text content are valid, regardless of the property setting. Setting CheckCharacters to false turns off character checking for character entity references.

But that's secondary to my point, which is that not only is it difficult to search for ROBCASHFLOW, even taking a simple note on him is a little iffy.

Which brings us to...

The Radioactive Player Handle

ROBCASHFLOW isn't the first or the only player to come up with a problematic handle out of, for all I know, sheer orneriness. It's hard to encounter handles like \vv/î££îåm, ·¨·.àçé.·¨·, or ¶ChäseK. without imagining that their owners took a sort of perverse Pinky and the Brain imp-glee in creating them. No offense to people who happen to prefer a slightly more obfuscated handle...

"HAHAHAHA! [angry nerd laugh] That'll show them who the clever one is. My handle contains SEVEN IRREGULAR CHARACTERS. I'm IMMUNE TO SEARCH, bitches!"

But there's another angle here. What happens when people, fully aware that their online usernames will be analyzed to death, design their handles for difficulty? To be as difficult as possible to work with? I did this way back when Paradise Poker was king and player tracking was in its infancy. I know others have done it in the years since.

For example, by creating a handle in which the first three characters are spaces (if the site allows it), you defeat any text processor that does typical string trimming:

string s = GetPlayerNameFromFileOrWherever();

s.Trim(); // Oops. We just trimmed part of the player's name

Alternately, you can embed multiple spaces inside the name:

John Doe

Which might cause problems if that name is ever displayed over HTML, where those spaces will likely get folded into a single space, or else represented a sequence of non-breaking spaces, neither of which preserves the original name perfectly.

Obviously as you start throwing control characters, so-called "extended ASCII" characters, and possibly Unicode into the mix, not to mention the different meaningful things you can do with punctuation...

"Hello, thank you for calling Acme Poker customer support. My name is Nancy. May I have your account username please?" "Sure. It's ';DELETE * FROM player--'." "Thank you, Mr. ';DELETE * FROM player--'. How may I assist you today?

...things start to get hairy, in a giant-hairy-tarantula-skittering-down-your-collarbone sort of way. Which is why I've always thought that the wide leeway online poker sites give their players in choosing handles is maybe, possibly, a bad idea. As much as I'm for giving users options, letting them invest in their identities, engage with the site, etc., and as much as having a flexible handle policy actually helps with that, the standard mantra of alphanumerics plus limited punctuation is there for a reason: it keeps usernames simple and relatively exploit-free.

And you know what else? It keeps usernames presentable. Consider what happens when a new player observes a real-money game of online poker for the first time, and sees people sporting names like:

\vv/î££îåm

...........42...........

assclown007

youpayformymeth$

Consider how awesome it will be for the game of online poker, from a PR standpoint, when some kid with a handle like Balls__2Ur__Chin wins the big mega-prize. That's what'll convince the world that poker is a game of skill and sportsmanship. Of course.

"Balls__2Ur__Chin sweeps the 2019 Online Poker MegaMillions Tourney; Wins Record 18mil."

So as much as the Zork-hacking nerd in me is amused by clever handles and embedded control characters, another part of me wishes there was a little more of a standard. Until there is, anytime you make the assumption that...

User names always contain normal, printable, visible, healthy, sane letters, numbers, and punctuation and nothing else

...players like \vv/î££îåm and the enigmatic ROBCASHFLOW will come out of the woodwork to blast that assumption to smithereens, whether they mean to or not.

Agree, disagree, have your own username horror story to share? Let us know.