diff --git a/irc/client.go b/irc/client.go
index 2627b6c0..897b6d72 100644
--- a/irc/client.go
+++ b/irc/client.go
@@ -88,7 +88,6 @@ func NewClient(server *Server, conn net.Conn, isTLS bool) *Client {
 			//TODO(dan): replace this with IsUsername/IsIRCName?
 			if Name(username).IsNickname() {
 				client.Notice("*** Found your username")
-				//TODO(dan): we do a bunch of user replacing in server.go userHandler, do we need that here?
 				client.username = Name(username)
 				// we don't need to updateNickMask here since nickMask is not used for anything yet
 			} else {
diff --git a/irc/server.go b/irc/server.go
index 69edcb88..a692dca6 100644
--- a/irc/server.go
+++ b/irc/server.go
@@ -400,6 +400,13 @@ func userHandler(server *Server, client *Client, msg ircmsg.IrcMessage) bool {
 		return false
 	}
 
+	// confirm that username is valid
+	//
+	if !Name(msg.Params[0]).IsNickname() {
+		client.Send(nil, "", "ERROR", "Malformed username")
+		return true
+	}
+
 	// set user info and log client in
 	//TODO(dan): Could there be a race condition here with adding/removing the client?
 	//TODO(dan): we should do something like server.clients.Replace(client) instead