Null character

<h2 id="representation">Representation</h2>
Since the null character is not a <a href="/facts/Printable_character/aCFyKyDT">printable character</a> representing it requires special notation in <a href="/facts/Source_code/o9J6Jv23">source code</a>.
In a <a href="/facts/String_literal/Fj41vtVm">string literal</a>, the null character is often represented as the <a href="/facts/Escape_sequence/r7lISrrw">escape sequence</a> \0 (for example, "abc\0def"). Similar notation is often used for a character literal (i.e. '\0') although that is often equivalent to the numeric literal for zero (0).<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a> In many languages (<a href="/facts/Escape_sequences_in_C/KktBuCXF">such as C</a>, which introduced this notation), this is not a separate escape sequence, but an octal escape sequence with a single <a href="/facts/Octal/4nRcq0Ce">octal</a> digit 0; as a consequence, \0 must not be followed by any of the digits 0 through 7; otherwise it is interpreted as the start of a longer octal escape sequence.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> Other escape sequences that are found in use in various languages are \000, \x00, \z, or \u0000. 
A null character can be placed in a <a href="/facts/URL/pPD5g7Wq">URL</a> with the <a href="/facts/Percent_encoding/zprLw5se">percent code</a> %00.
The ability to represent a null character does not always mean the resulting string will be correctly interpreted, as many programs will consider the null to be the end of the string. Thus, the ability to type it (in case of <a href="/facts/Unchecked_user_input/4967Sm1s">unchecked user input</a>) creates a <a href="/facts/Vulnerability_(computing)/jg0Gr71M">vulnerability</a> known as null byte injection and can lead to security exploits.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a>
In <a href="/facts/Software_documentation/cSXDUPPg">software documentation</a>, the null character is often represented with the text NUL (or NULL although that may mean the <a href="/facts/Null_pointer/66zwVEfL">null pointer</a>). In <a href="/facts/Unicode/DDu3MfPV">Unicode</a>, there is a character for this: U+2400 ␀ SYMBOL FOR NULL.
In <a href="/facts/Caret_notation/IHAVdW9R">caret notation</a> the null character is ^@. On some keyboards, one can enter a null character by holding down Ctrl and pressing @ (on US layouts just Ctrl+2 will often work, there being no need for ⇧ Shift to get the @ sign).

<h2 id="external-links">External links</h2>
<ul><li><a href="http://projects.webappsec.org/Null-Byte-Injection">Null Byte Injection</a> WASC Threat Classification Null Byte Attack section</li>
<li><a href="http://www.hackthis.co.uk/articles/common-php-attacks-poison-null-byte">Poison Null Byte Introduction</a> Introduction to Null Byte Attack</li>
<li><a href="/facts/Apple_Inc./oTJYta3k">Apple</a> <a href="http://projects.webappsec.org/Null-Byte-Injection">null byte injection</a> <a href="/facts/QR_code/B0l0IS7a">QR code</a> <a href="https://github.com/cloudsecurityalliance/gsd-database/issues/2322">vulnerability</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">ASCII format for Network Interchange. IETF. sec. 5.2. doi:10.17487/RFC0020. RFC 20. NUL (Null): The all-zeros character which may serve to accomplish time fill and media fill. <a href="https://datatracker.ietf.org/doc/html/rfc20#section-5.2" target="_blank">https://datatracker.ietf.org/doc/html/rfc20#section-5.2</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"The set of control characters of the ISO 646" (PDF). Secretariat ISO/TC 97/SC 2. 1975-12-01. p. 4.4. Archived from the original (PDF) on 2014-05-12. Position: 0/0, Name: Null, Abbreviation: Nul <a href="https://web.archive.org/web/20140512221203/http://kikaku.itscj.ipsj.or.jp/ISO-IR/001.pdf" target="_blank">https://web.archive.org/web/20140512221203/http://kikaku.itscj.ipsj.or.jp/ISO-IR/001.pdf</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">"Unicode Character 'NULL' (U+0000)". Retrieved 2018-10-20. <a href="https://www.fileformat.info/info/unicode/char/0000/index.htm" target="_blank">https://www.fileformat.info/info/unicode/char/0000/index.htm</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">"C0 Controls and Basic Latin" (PDF). Unicode Consortium. 2018. Retrieved 2018-10-20. <a href="https://www.unicode.org/charts/PDF/U0000.pdf" target="_blank">https://www.unicode.org/charts/PDF/U0000.pdf</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">"A byte with all bits set to 0, called the null character, shall exist in the basic execution character set; it is used to terminate a character string literal." — ANSI/ISO 9899:1990 (the ANSI C standard), section 5.2.1 <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">"A string is a contiguous sequence of characters terminated by and including the first null character" — ANSI/ISO 9899:1990 (the ANSI C standard), section 7.1.1 <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Working Draft, Standard for Programming Language C++ (PDF) (ISO 14882 standard working draft), ISO/IEC, 28 February 2011, p. 427, N3242=11-0012, retrieved 27 February 2013, A null-terminated byte string, or NTBS, is a character sequence whose highest-addressed element with defined content has the value zero (the terminating null character); no other element in the sequence has the value zero. <a href="http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2011/n3242.pdf" target="_blank">http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2011/n3242.pdf</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Kernighan and Ritchie, C, p. 38: "The character constant '\0' represents the character with value zero, the null character. '\0' is often written instead of 0 to emphasize the character nature of some expression, but the numeric value is just 0." <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">In YAML this combination is a separate escape sequence. <a href="/wiki/YAML" target="_blank">/wiki/YAML</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Null Byte Injection WASC Threat Classification Null Byte Attack section. <a href="http://projects.webappsec.org/Null-Byte-Injection" target="_blank">http://projects.webappsec.org/Null-Byte-Injection</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
</ol>

Null character open-in-new

Null character