diff --git a/server/src/controllers/auth.controller.ts b/server/src/controllers/auth.controller.ts
index 1690ff4..2e2b067 100644
--- a/server/src/controllers/auth.controller.ts
+++ b/server/src/controllers/auth.controller.ts
@@ -19,6 +19,13 @@ export const guestSession = async (req: Request, res: Response) => {
     try {
         const name = xss(req.body.name);
 
+        const pattern = /^[A-Za-z0-9_]+$/;
+
+        if (!pattern.test(name)) {
+            res.status(400).end();
+            return;
+        }
+
         if (!req.session.user || !req.session.user?.id) {
             // create guest session
             const user: User = {