[Bonus] Account not found

[arisu]

If the database just used prepared statements then the character limitations would not be needed. I'm guessing the database does the old-school naive method of input sanitization. The server-side code is closed source, so all I can do is speculate.

[calxalot]

I don’t know what method is used.
Joseph claimed it is handled ok by fah servers. The concern was 3rd party tools being possibly exposed to injection attacks.