Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am testing an web-based enterprise application created in Asp.Net. I am testing a text box which accepts alpha-numeric character and maximum 255 chars. Apart from normal boundary values, nulls, negative data inputs what are some unique, invalid and out of the box data inputs, that will surely crash the application. Some clever ideas in general that will force the application to stall or stop functioning.

Thanks in Advance!!

share|improve this question

Honestly, the only limit is your imagination. You'll find out pretty quickly if the programmers took the permissive approach (allow everything except...) or the repressive approach (prevent everything except...)

Some examples you can use:

  • Copy/Paste the entire text of Hamlet (thanks to QA Hates You for this one (you'll have to google for it - I don't have access at work)) into the field.
  • Drag/Drop the entire text of Hamlet into the field. It's possible someone thought to prevent copy/paste but not drag/drop.
  • Try some SQL injection... or code snippets.
  • Or HTML
  • If there's anything that logically shouldn't be there (like a negative age), try to enter it.
  • Change your browser language and input data in that language (or build a virtual with a foreign language keyboard layout and foreign language OS, then use that to enter data - it will catch places where the programmers are using key-press recognition rather than string checks to identify special characters)
  • Hold down a key. Does input stop at the field size limit or not?

None of these ideas will necessarily break the application - a really good development team will have limited input in a way that prevents anything not explicitly allowed and then checks and cleans anything that gets through despite their precautions.

share|improve this answer

try non-ascii characters. Few to chose from: And whole universe of Chinese, Indian etc scripts. Try Google translate for that.

share|improve this answer
i tried and found that it converts into "?" symbol when text box is out of focus. – tester Aug 12 '14 at 13:51
congrats you just found the bug :-) – Peter Masiar Aug 12 '14 at 23:23

A simple but good test is also to test HTML character codes. Your application may also the specific characters such &, # and numeric values which stringed together could make something like &#174 which just so happens to be the registered symbol.

If it is accepted you need to make sure that where ever that data comes out again that it's still &#174 and not a ® symbol.

The reverse is to enter the special characters and ensure they come out in the right format, assuming they're valid as per your requirements.

share|improve this answer

Thumbs up for all the above answers.. Would like to add one more.

Try inputting <> angular braces or HTML close tag in input field. Also try this on URL.

If you see a stack trace or yellow page that means there is an issue with url redirect.

share|improve this answer

Best thing to enter as input are some simple example of SQL injection or HTML like:

  1. <script>alert("123")</script>
  2. <script>alert(document.cookie)</script>
  3. <html><a>"Testing"</a></html> etc...
share|improve this answer

Here's an article that covers many of the ideas above and some others: How Skeleton Strings Can Help Your Testing.

share|improve this answer

Try typing this in the textfield, &#160; or &#160

Here's regex that replaces these input.

val= val.replace(/&#(\S*)\d;/g, ' ').replace(/&#(\S*)\d/g, ' ');

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.