Password may not contain: select, insert, update, delete, drop (id.uni-lj.si)

Article summary

A password reset page has a restriction on password content, disallowing certain SQL keywords. The page provides guidelines for creating a strong password, including a minimum length and required character types. Users are advised to avoid easily guessable information in their passwords. The password reset process requires users to enter their personal information and username.

Main themes

• SQL injection prevention
• password security
• input validation
• security best practices
• password hashing
• data protection

What commenters say

• Sanitizing input is not a reliable method for preventing SQL injection and parameterized SQL is a better approach.
• Hashing passwords on the client-side can be problematic as it effectively changes the password to the hash of the password.
• Storing passwords securely requires careful handling to prevent unauthorized access, and transmitting passwords in plaintext is a security risk.
• Using a stored procedure for hashing passwords can be unambiguously bad due to the risk of data leakage.
• Input validation and sanitization can be flawed if not implemented correctly, potentially leading to user experience issues or security vulnerabilities.
• Proper security measures, such as parameterized SQL and secure password storage, are essential for protecting user data.
• Overly restrictive input validation can lead to issues with user passwords being silently modified or rejected.
• Security best practices should prioritize secure password handling and storage to prevent potential attacks and data breaches.