Check user registration data

[Remitur]

Try to register a new user account on your own WHMCS.
When you're asked for "first name", insert a random text, whatever length... i.e. something like this:

Quote

In by an appetite no humoured returned informed. Possession so comparison inquietude he he conviction no decisively. Marianne jointure attended she hastened surprise but she. Ever lady son yet you very paid form away. He advantage of exquisite resolving if on tolerably. Become sister on in garden it barton waited on.

Consulted he eagerness unfeeling deficient existence of. Calling nothing end fertile for venture way boy. Esteem spirit temper too say adieus who direct esteem. It esteems luckily mr or picture placing drawing no. Apartments frequently or motionless on reasonable projecting expression. Way mrs end gave tall walk fact bed.

So insisted received is occasion advanced honoured. Among ready to which up. Attacks smiling and may out assured moments man nothing outward. Thrown any behind afford either the set depend one temper. Instrument melancholy in acceptance collecting frequently be if. Zealously now pronounce existence add you instantly say offending. Merry their far had widen was. Concerns no in expenses raillery formerly.

Resources exquisite set arranging moonlight sex him household had. Months had too ham cousin remove far spirit. She procuring the why performed continual improving. Civil songs so large shade in cause. Lady an mr here must neat sold. Children greatest ye extended delicate of. No elderly passage earnest as in removed winding or.

She wholly fat who window extent either formal. Removing welcomed civility or hastened is. Justice elderly but perhaps expense six her are another passage. Full her ten open fond walk not down. For request general express unknown are. He in just mr door body held john down he. So journey greatly or garrets. Draw door kept do so come on open mean. Estimating stimulated how reasonably precaution diminution she simplicity sir but. Questions am sincerity zealously concluded consisted or no gentleman it.

Satisfied conveying an dependent contented he gentleman agreeable do be. Warrant private blushes removed an in equally totally if. Delivered dejection necessary objection do mr prevailed. Mr feeling do chiefly cordial in do. Water timed folly right aware if oh truth. Imprudence attachment him his for sympathize. Large above be to means. Dashwood do provided stronger is. But discretion frequently sir the she instrument unaffected admiration everything.

Folly words widow one downs few age every seven. If miss part by fact he park just shew. Discovered had get considered projection who favourable. Necessary up knowledge it tolerably. Unwilling departure education is be dashwoods or an. Use off agreeable law unwilling sir deficient curiosity instantly. Easy mind life fact with see has bore ten. Parish any chatty can elinor direct for former. Up as meant widow equal an share least.

Oh to talking improve produce in limited offices fifteen an. Wicket branch to answer do we. Place are decay men hours tiled. If or of ye throwing friendly required. Marianne interest in exertion as. Offering my branched confined oh dashwood.

Perceived end knowledge certainly day sweetness why cordially. Ask quick six seven offer see among. Handsome met debating sir dwelling age material. As style lived he worse dried. Offered related so visitor we private removed. Moderate do subjects to distance.

Scarcely on striking packages by so property in delicate. Up or well must less rent read walk so be. Easy sold at do hour sing spot. Any meant has cease too the decay. Since party burst am it match. By or blushes between besides offices noisier as. Sending do brought winding compass in. Paid day till shed only fact age its end.

Use the very same text also for surname.
And for company name.
And for address, and for whatever field does not check the data you inserted.
And for email a fake address on a non-existing domain.
It's not a joke: You'll be able to register a new account with those crazy data, because:

1-  WHMCS does not check the data in any way

2 - the  data are saved in db using a "text" type field for each one... and this means that the limit of a name, or of a surname, is 65535 chars

Question: how many people has a name long 65535 chars?

How many surnames long 65535 do you know?

This is more than an issue, because i.e. in an attack it may be used to register hundreds of fake users, each using a huge amount of data, and bringing your db dimensions out of limits.
Or registering using long string and special chars may bring your template going crazy...

But you can also register using near-real data, but a disposable email address, and use this disposable email address to commit fraud (i.e., buying services using cloned credit cards). 

So I created a "check user data hook" that:

1 - limit the length of any field you can insert to 150 chars

2 - check the email address, in order not to allow registering using disposable addresses or on non-existing domains

The hook is available for free on Github ( https://github.com/DomainRegister/WHMCS ) or on DomainRegister's site:  https://domainregister.international/index.php/knowledgebase/696/Check-User-Data-for-Better-WHMCS-Security.html

Credits: thank to @bear and @leemahoney3 for the help in silly bug hunting...