Fixes #3704 displaying error messages when adding users through admin interface

1 files changed, 2 insertions, 0 deletions

diff --git a/engine/lib/users.php b/engine/lib/users.php
index 2d6b7cabd..ce1b409f6 100644
--- a/engine/lib/users.php
+++ b/engine/lib/users.php
@@ -813,6 +813,7 @@ function validate_username($username) {
 	if (
 		preg_match($blacklist, $username)
 	) {
+		// @todo error message needs work
 		throw new RegistrationException(elgg_echo('registration:invalidchars'));
 	}
 
@@ -823,6 +824,7 @@ function validate_username($username) {
 	for ($n = 0; $n < strlen($blacklist2); $n++) {
 		if (strpos($username, $blacklist2[$n]) !== false) {
 			$msg = elgg_echo('registration:invalidchars', array($blacklist2[$n], $blacklist2));
+			$msg = htmlentities($msg, ENT_COMPAT, 'UTF-8');
 			throw new RegistrationException($msg);
 		}
 	}