320
Please create a non-secure password. (lemmy.world)
submitted 2 years ago by to c/mildlyinfuriating@lemmy.world
80 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 2 years ago (1 child)

Seems to be they're dropping the passwords in the database in plain text, but they're deathly afraid that someone will drop a '; in there or something and the insert will break.

Notwithstanding that storing passwords in plain text is a slapping with the 10 foot rubber chicken, but mysqli_real_escape_string() or any number of other similar solutions are indeed a thing that exists. A prepared statement would work, too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago (1 child)

    but mysqli_real_escape_string() or any number of other similar solutions are indeed a thing that exists. A prepared statement would work, too.

    You make it sound as if a prepared statement is a last resort. I would turn that around: as a rule always use prepared statements when dealing with user input. It's very easy to forget a single call to mysqli_real_escape_string().

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago* (last edited 2 years ago)

    I was thinking more along the lines of the types of laziness/ineptitude most likely present at wherever OP's example were being written. Escape string is one line of code for this whereas preparing a statement is like five.

    But really they should just be hashing it. Then the input doesn't matter.

  • permalink
  • fedilink
  • source
  • parent