Valid character set for website passwords

Question

Hi, I made up a regular expression for the password field of my site and was worried:

Are there any characters that I should block the user? If so, why?

Or is it enough to simply avoid dangerous characters like = and 'when processing data? It seems like this topic should list php functions to speed them up if you would do this.

Thanks!

Answer 1

I use everything that the user enters as a password, so I don’t care what they enter, he never touches my database and can not do any harm. md5 ($ _ POST ['password'])

Other fields are another story ...

mysql_real_escape_string() is a great function for escaping data in queries.

Answer 2

As other people have said, hashing a user's password before storing it in the database will mean that you do not need to worry about what the user enters.

While we are talking about hashing, you might even think about adding salt to the password before hashing it. A salt is a random string (for example, the user's email address), which will help to improve the uniqueness of the generated hash (different users with the same password will generate the same hash without salt).

For more information read: http://phpsec.org/articles/2005/password-hashing.html

Answer 3

No restrictions should be set with passwords. Let the user decide.

As for escaping characters to enter the database, not necessary; Just do some SQL injection research

Answer 4

What exactly are you protecting? If this is an SQL injection, then you should not rely on escaping user-specified parameters, you should use parameterized queries.

http://us.php.net/manual/en/mysqli-stmt.bind-param.php

Answer 5

None of this should be a problem if you avoid everything that the user enters on the server side. You can see more information in Where to use mysql_real_escape_string to prevent SQL Injection? .

Answer 6

I use the MD5 / Hash and BASE64 ENCODE functions for passwords, so I really don't care what they enter if they meet the minimum requirements ... It is recommended that you use strongly typed passwords.

 function get_rnd_iv($iv_len) { $iv = ''; while ($iv_len-- > 0) { $iv .= chr(mt_rand() & 0xff); } return $iv; } function md5_encrypt($string_value, $salt_key, $iv_len = 16) { $string_value .= "\x13"; $n = strlen($string_value); if ($n % 16) $string_value .= str_repeat("\0", 16 - ($n % 16)); $i = 0; $enc_text = get_rnd_iv($iv_len); $iv = substr($salt_key ^ $enc_text, 0, 512); while ($i < $n) { $block = substr($string_value, $i, 8) ^ pack('H*', md5($iv)); $enc_text .= $block; $iv = substr($block . $iv, 0, 512) ^ $salt_key; $i += 16; } return urlencode(base64_encode($enc_text)); } function md5_decrypt($enc_text, $salt_key, $iv_len = 16) { $enc_text = urldecode(base64_decode($enc_text)); $n = strlen($enc_text); $i = $iv_len; $string_value = ''; $iv = substr($salt_key ^ substr($enc_text, 0, $iv_len), 0, 512); while ($i < $n) { $block = substr($enc_text, $i, 8); $string_value .= $block ^ pack('H*', md5($iv)); $iv = substr($block . $iv, 0, 512) ^ $salt_key; $i += 16; } return preg_replace('/\\x13\\x00*$/', '', $string_value); }