Via HackerOne. In regular expressions, "$" matches "end of input, or before terminating newline". This means that the expression /^A$/ matches two strings: "A", and "A\n".

When we care about this, use \z instead, which matches "end of input" only.

This allowed registration of "username\n" and similar.

• Grepped codebase for all calls to preg_match() / preg_match_all().
• Fixed the ones where this seemed like it could have an impact.
• Added and executed unit tests.