PHP password_hash return value and SQL

Question

There are lots of questions about password_hash() function but non answered my question:

I am trying to find information about password_hash function return value. All I see is that it returns the actual hash.

I am planning to save the hash in SQL table.

Can the hash contain quotes? If it can contain quotes, will I have to escape the hash before inserting it?

Thank you

martinstoeckli · Accepted Answer · 2016-02-09 20:45:45Z

3

There is no need for escaping a BCrypt hash, regarding SQL-injection. A BCrypt hash calculated by password_hash() is base64 encoded, it contains only "harmless" characters of this alphabet...

./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

...plus the & sign to separate the parameters. That said, it is still a good idea to use parametrized queries of course.

answered Feb 9, 2016 at 20:45

martinstoeckli

24.2k7 gold badges63 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Makketronix Over a year ago

Yes, parametrized queries are the way to go indeed. Good to know that password_hash() is base64.

Collectives™ on Stack Overflow

PHP password_hash return value and SQL

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related