A set of valid characters for web site passwords

Question

Hi I was composing a regex for a password field of my site and had a concern:

Are there any characters I should block a user from entering? If so why?

Or is it enough just to escape dangerous characters like = and ' when processing data? It seems good for this topic to list the php functions for escaping those, if you would.

Thanks!

Answer 1

None of this should be a problem as long as you escape everything the user enters on the server side. You can see more information at http://stackoverflow.com/questions/2312051/where-to-use-mysql-real-escape-string-to-prevent-sql-injection.

Answer 2

No restrictions should be placed passwords. Let the user decide.

As for escaping characters for database entry, no need; Just do some research on SQL Injection

Answer 3

I hash anything a user enters as a password, so I don't care what they enter, it never touches my database and can't cause any harm. md5($_POST['password'])

Other fields are a different story...

Answer 4

What specifically are you guarding against? If it's SQL injection, then you shouldn't rely on escaping the user-supplied parameters, you should be using parameterized queries.

http://us.php.net/manual/en/mysqli-stmt.bind-param.php

Answer 5

Like other people have already said, hashing the users password before saving it to the database will mean you don't have to worry about what the user enters.

Whilst we're on the subject of hashing, you might even want to consider adding a 'salt' to the password before it is hashed. A salt is a random string (for example, the user's email address) that will help to improve the uniqueness of the hash generated (different users that have the same password will generate the same hash without the salt).

For more information take a read of: http://phpsec.org/articles/2005/password-hashing.html

Answer 6

I utilize MD5/Hash and BASE64 ENCODE Functions for passwords, so I haven't really a care what they enter as long as they meet minimum requirements...Strongly typed passwords are recommended.

function get_rnd_iv($iv_len)
    {
        $iv = '';
        while ($iv_len-- > 0) {
            $iv .= chr(mt_rand() & 0xff);
        }
        return $iv;
    }

    function md5_encrypt($string_value, $salt_key, $iv_len = 16)
    {
        $string_value .= "\x13";
        $n = strlen($string_value);
        if ($n % 16) $string_value .= str_repeat("\0", 16 - ($n % 16));
        $i = 0;
        $enc_text = get_rnd_iv($iv_len);
        $iv = substr($salt_key ^ $enc_text, 0, 512);
        while ($i < $n) {
            $block = substr($string_value, $i, 8) ^ pack('H*', md5($iv));
            $enc_text .= $block;
            $iv = substr($block . $iv, 0, 512) ^ $salt_key;
            $i += 16;
        }
        return urlencode(base64_encode($enc_text));
    }

    function md5_decrypt($enc_text, $salt_key, $iv_len = 16)
    {
        $enc_text = urldecode(base64_decode($enc_text));
        $n = strlen($enc_text);
        $i = $iv_len;
        $string_value = '';
        $iv = substr($salt_key ^ substr($enc_text, 0, $iv_len), 0, 512);
        while ($i < $n) {
            $block = substr($enc_text, $i, 8);
            $string_value .= $block ^ pack('H*', md5($iv));
            $iv = substr($block . $iv, 0, 512) ^ $salt_key;
            $i += 16;
        }
        return preg_replace('/\\x13\\x00*$/', '', $string_value);
    }