JEEBBS v3.0 user registration logic vulnerability and another storage xss

1. What do you think of when you see 'username' varchar (100) not null comment 'username' when registering a dangerous user name? Why is the username so long. Enter a string between 3 and 20. That is to say, if this condition is met and the user name does not repeat, right? Because I already know that the user name can be 100 characters in length, you can register a user name with 100 characters without judging the format. When sending data packets, the interception request is modified to the xss code to be registered:

You can reply to or post any post, or see the registered xss user name. 2. Post a voting post on xss with the title xss.

Solution:

The username field does not really take that long. The username Regular Expression and post parameter are filtered.