News for hackers. Stuff that matters.

A comment on NULL license plate not such a bright idea. Parent comment

Re:NULL license plate not such a bright idea by pc86 on Monday August 12, 2019 @05:52PM (#20680436)
If passwords are hashed should any character be prohibited at all?
[ Parent | on HN ]
Re:NULL license plate not such a bright idea by tobyhinloopen on Monday August 12, 2019 @06:17PM (#20680658)
Some do MD5($password) in a sql string.

I don’t... but i’ve seen it

[ Parent | on HN ]
Re:NULL license plate not such a bright idea by userbinator on Monday August 12, 2019 @09:15PM (#20681906)
MD5 and all other hashes still take arbitrary bytes as input, so they wouldn't be the source of any restrictions; I suspect the majority of them are due to character set/encoding issues more than anything else.
[ Parent | on HN ]
Re:NULL license plate not such a bright idea by gruez on Monday August 12, 2019 @09:36PM (#20682012)
Presumably he's talking about code like this:

   $cursor.execute("SELECT * FROM users WHERE username = '$username' AND hash = MD5('password')")
Allowing any value would allow for SQL injections, so the programmer does the lazy thing and "sanitize" the inputs ($username/$password) with a roll-your-own "sanitizing" function that throws an error if there are "evil" characters.
[ Parent | on HN ]