Yrs. But you presume that these password rules are there for security. I'm saying they are there because some part of the stack is stupid. I'm quite certain yo

Yrs. But you presume that these password rules are there for security. I'm saying they are there because some part of the stack is stupid. I'm quite certain you cannot breach security like that, but that some (ancient) piece of the stack has some hardwired rules, which, at some point, might indeed be a "defence against injection". But this is no proof that this is still the case.