For example:

$username = request_var('username', '', true);

utf8_normalize_nfc() needs to be used here and a couple of other places in the file.