This: > "don't accept ' or 1=1 -- as a password" (the way that it's stated) implies that one should be checking input for possible SQL injection attacks and d

This: > "don't accept ' or 1=1 -- as a password" (the way that it's stated) implies that one should be checking input for possible SQL injection attacks and dropping the request, rather than sanitizing input so that the attack doesn't work, but the password is valid.