PHP login password question

Question

What characters should I allow users to enter as their password?

Quentin · Accepted Answer · 2011-01-20 06:46:53Z

4

Whatever characters they like. Being told your password is too secure is simply annoying.

answered Jan 20, 2011 at 6:46

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

John M. Over a year ago

Of course, be sure to hash it with some md5, sha1, and other magic. It really pisses me off when sites restrict my characters because the only real reason they would do that is to protect themself from SQL injection, if they didn't sanitize a plaintext password stored in a database. I really hope they aren't storing my password plaintext. So they're either insecure or forcing me to be insecure.

JP19 · Accepted Answer · 2011-01-20 06:47:12Z

0

Theoretically, there is no restriction that you need to have. But from programming ease point of view, I know that ' should not not allowed (mysql injection, etc but if code is written properly, it should not be a problem).

answered Jan 20, 2011 at 6:47

JP19

Comments

Rafe Kettler · Accepted Answer · 2011-01-20 06:48:34Z

0

Depends on how much security you need. I say upper and lower case letters, numbers, and the majority of symbols (all the top-row symbols, plus question mark, comma, period and maybe a few others).

You should be as unrestrictive as possible. Let people use what characters they want.

answered Jan 20, 2011 at 6:48

Rafe Kettler

77.1k21 gold badges160 silver badges151 bronze badges

Comments

GolezTrol · Accepted Answer · 2011-01-20 06:50:29Z

0

Any character they like, and any length they like (except maybe not over your PHP Post limit). In a good password system, you only store the hash, and when logging in, you only send the hash as well. So it shouldn't matter.

And even if you store the password, you should escape any string you put in the database (mysql_real_escape_string), so any character could and should be allowed. If you store the actual password, you could limit the length to the field size, which I think should be at least 200 chars in that case.

answered Jan 20, 2011 at 6:50

GolezTrol

116k19 gold badges186 silver badges215 bronze badges

Comments

Nanne · Accepted Answer · 2011-01-20 06:51:03Z

0

I think you should deside what character set you are using, and limit it only to that. So if you are not using UTF8 but e.g. ISO-8859-1, you don't want them writing multi-byte characters.

answered Jan 20, 2011 at 6:51

Nanne

64.4k16 gold badges122 silver badges166 bronze badges

Comments

shamittomar · Accepted Answer · 2011-01-20 06:56:03Z

0

Anything available on a standard en-US keybaord is fine.

answered Jan 20, 2011 at 6:56

shamittomar

46.8k12 gold badges77 silver badges81 bronze badges

Comments

Trivikram · Accepted Answer · 2011-01-20 07:40:54Z

0

You can allow any characters to be inserted in the password. Please ensure that you validate the input to prevent MySQL Injection - if encryption is not used. It's advisable to encrypt the passwords by using at least MD5() or SHA1().

answered Jan 20, 2011 at 7:40

Trivikram

8611 gold badge9 silver badges17 bronze badges

Comments

Alfred · Accepted Answer · 2011-01-20 11:13:06Z

0

I think the should be allowed to enter every letter they want. But you should enforce a proper length for the password to make it more secure. Also I would advise you to use federated login if you could:

openid: lightopenid is a really easy library.
facebook connect
twitter single sign-in

These alternatives are going to be way securer.

answered Jan 20, 2011 at 11:13

Alfred

62k33 gold badges151 silver badges186 bronze badges

Collectives™ on Stack Overflow

PHP login password question

8 Answers 8

1 Comment

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

1 Comment

Comments

Comments

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related