Why Testing With Repeated Strings Reveals the Limits Your Code Doesn't Know It Has

String repetition in template engines and code generation has a failure mode that doesn't exist for small inputs: what happens at the boundary where the repeated output exceeds memory, exceeds a database column's VARCHAR limit, or exceeds an HTTP request body size limit

The previous articles on this site covered stress testing with repetitive data, string repetition across languages, ANSI escape codes and terminal UIs, and catastrophic slowdowns from repeating 1,000,000 times. This article addresses string repetition in infrastructure and configuration contexts — the specific places where repeated strings interact with system limits in non-obvious ways.

The textarea and input length problem: what HTML says vs what backends enforce

HTML form inputs have a maxlength attribute that limits input in the browser. Sending a repeated string that exceeds maxlength demonstrates two things:

1. Whether the server-side validation independently enforces the same limit (it should — client-side validation is UI convenience, not security)
2. Whether the limit on the frontend matches the database column limit on the backend

The common mismatch: a form input with maxlength="255" storing data in a VARCHAR(200) column — or the reverse, a VARCHAR(500) column with a maxlength="100" input that doesn't expose the full available storage. Both are implementation inconsistencies that cause different symptoms:

• Frontend limit > backend limit: data passing client validation fails on backend
• Frontend limit < backend limit: users unnecessarily restricted from filling the column

Testing with a string repeater: repeat a simple character 300 times, paste into the textarea, submit. The server should reject it with a validation error if the limit is properly enforced backend-side. If it silently truncates, the database is truncating — a data loss scenario.

Repeated separators and CSV generation: the delimiter collision

When generating CSV programmatically, the separator character choice interacts with content that might contain that separator:

name,value,notes
Alice,42,"Some notes"
Bob,100,"Notes with a, comma"   ← contains the separator

The standard CSV fix is quoting: wrap fields containing the separator in quotes. But what if the test data itself is a repeated comma? ,,,,,,,,,, is valid CSV with 11 empty fields — but if your test data generator produces commas as the "content" and your CSV writer doesn't quote it, the output breaks.

String repeater use case: generate "," × 50 to produce a string of commas. Paste it into a form field that will be exported to CSV and verify the export handles comma-in-content correctly — the generated CSV row should have this value quoted.

Template engines and infinite loops via repetition

Template engines (Jinja2, Handlebars, Liquid, Blade, etc.) can interact unexpectedly with very long repeated strings in some contexts:

Regex-based template parsing: some template engines parse input with regular expressions. A template string containing 10,000 repetitions of a near-match pattern can trigger catastrophic backtracking in the template engine's parser — an entirely different class of DoS vulnerability from the ReDoS problem in user-provided regex, because here the user-provided data triggers backtracking in the engine's own parsing.

Output escaping and string length: template engines typically HTML-escape output. A repeated < character (50,000 times) becomes < 50,000 times in the escaped output — 4× the original length. If the output buffer has a size limit, input that appears safe in raw form may exceed limits after escaping.

DNS TXT records and repetition limits

DNS TXT records are a specific context where string length limits interact with repeated content in infrastructure:

SPF records use include:, ip4:, and other mechanisms that accumulate into the TXT record value. The DNS TXT record string limit is 255 bytes per string (though multiple strings can be concatenated). If a single repeated string in a TXT record (e.g., a repeated authorization token for a third-party service) exceeds 255 bytes, it must be split across multiple quoted strings:

"v=spf1 " "ip4:1.2.3.4 ip4:5.6.7.8 ip4:9.10.11.12 " "-all"

For testing DNS configuration tools: generating a string repeated to just over 255 bytes and attempting to set it as a single TXT record string will reveal whether the tool or API correctly splits or rejects over-limit strings.

HTTP headers and repeated content

HTTP headers have limits that aren't always enforced by application code — they're typically enforced by the web server or proxy:

• Nginx default header size limit: 8KB
• Apache default header size limit: 8KB per header, 8KB total
• AWS ALB: 16KB total header size

Testing with a string repeater: generate a 10KB string and attempt to send it as an HTTP header value via an API that stores custom headers. The web server may reject it with a 431 Request Header Fields Too Large response; if the web server doesn't reject it, the application might store it — potentially causing issues when the stored header is later read and echoed in responses.

Padding generation: fixed-width formatting with repetition

String repetition has a legitimate production use beyond testing: generating fixed-width text output where values must be padded to a specific width:

Fixed-width file formats: some legacy data exchange formats (COBOL-era systems, some banking and government formats) use fixed-width fields. "JOHN SMITH" padded to 30 characters with trailing spaces: JOHN SMITH — 10 characters of name + 20 spaces (produced by repeating " " 20 times).

Report formatting: aligning tabular text output requires padding shorter values to match the width of the longest value. Repeating the space or pad character to the required count produces the alignment.

Progress indicators: a simple text progress bar consists of a repeated block character (█) for completed progress and repeated space or dash for remaining — the count of each repetition determined by the completion percentage.

How to use the String Repeater on sadiqbd.com

1. For testing input limits: choose a distinctive character (X, or @), set the repeat count to values like 100, 255, 256, 500, 1000, 4096 — these correspond to common limits in databases, DNS, and application fields; test whether the system correctly handles, rejects, or truncates at each boundary
2. For separator generation: repeat the separator character (comma, pipe, tab) a known number of times to generate test data that stresses CSV, TSV, or delimited-format parsers
3. For padding generation: repeat the pad character (space, zero) to the required count and concatenate with the value to produce fixed-width formatted output

Frequently Asked Questions

Is there a maximum practical length for a repeated string before tools or browsers start behaving oddly? Different limits apply in different contexts. Browser text areas typically handle several megabytes of text without issue, though rendering very long single-line content without line breaks may cause layout problems. Clipboard paste operations can handle tens of megabytes. Most applications that accept text input have their own limits (form field maxlength, textarea row limits, database column sizes). The interesting failure modes are at specific thresholds: 255 bytes (DNS TXT string limit), 256 characters (common VARCHAR limit), 65,535 characters (max VARCHAR in some databases), 2MB (common request body limits). Testing at and around these specific thresholds reveals whether limits are enforced correctly — rather than testing with arbitrarily large inputs.

Is the String Repeater free? Yes — completely free, no sign-up required.

Try the String Repeater free at sadiqbd.com — repeat any string any number of times with a custom separator instantly.