Level 15
Use proper validation rules, for example, the string rule as I understand it only checks with is_string, that will allow dots. What you want it to use is either alpha, alpha_num depending on if you want usernames to contain numbers, and alpha_dash for alpha-numeric characters, dashes, and underscores.
$input = [
'username' => 'index.php',
];
$validator = Validator::make($input, [
'username' => 'required|string',
]);
$validator->valid(); // ["username" => "index.php"]
$validator = Validator::make($input, [
'username' => 'required|alpha',
]);
$validator->valid(); // []