Password may not contain: select, insert, update, delete, drop

Re:Password may not contain: select, insert, update, delete,... by sevensevennine on Sunday January 21, 2024 @09:16AM (#39078599)

Don't hash the password on the client. That just changes the password to the hash of the password.

Parameterize the SQL on the server instead of concatenating strings.

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by hn_acker on Sunday January 21, 2024 @10:49AM (#39079489)

If you're using a third-party reverse proxy, then the third party will have access to the user's password. What's the simplest way to prevent the third-party from knowing the password? Would adding an encryption layer between the user and the actual website owner be both feasible and sufficient for the average website owner?

[ Parent | on HN ]

Re:Password may not contain: select, insert, update, delete,... by Falmarri on Sunday January 21, 2024 @02:03PM (#39081674)

Don't use reverse proxies you don't trust

[ Parent | on HN ]