4 ms·

Blocking these: ?, <, >,(, ), ',", /,\,& probably came from a fear of SQL injection.

• pwg 8y ago
  Arbitrary limitations on characters, esp. on the set of punctuation style characters like the above, is an externally visible code smell of a site using plaintext storage of passwords. If the passwords were properly salted and hashed (preferably with a KDF) then the output when shown to humans would normally be a hex encoded string. With only the characters [0-9a-f] appearing in the hex encoded string, there is zero risk of SQL injection, so there would be no need to restrict the users from these characters. Restricting the characters implies that some portion of the system handling the passwords will see the raw input from the user and might break should those characters appear. But a properly hashed password up front would insulate those systems from the users input. So a character restriction implies a lack of proper password hashing, and a lack of hashing implies a high probability of plaintext storage of those same passwords.