> And really if this works in the first place you're storing the passwords unhashed Not really, your RDBMS probably supports some hash functions so you could b

> And really if this works in the first place you're storing the passwords unhashed Not really, your RDBMS probably supports some hash functions so you could be storing them hashed as "UPDATE USERS SET PASSWORD = SHA2($PASSWORD)" which would be vulnerable to SQL injection yet does not store unhashed passwords. There are good reasons I'd recommend to do the hashing in the application layer instead, but doing it in the DB (with correctly parameterized queries, of course) is not so terrible.