CODEWITHSUNDEEP
asp.netsecurityinputpasswordssanitization
XSL
XSL

Reputation: 3055

Is password input sanitization required?

I'm trying to sanitize any data that's inputted by making sure the data is valid for a particular field (e.g. a name can't contain special characters/numbers etc..) However, I'm not sure what to do when it comes to a password field. Would I even need to bother with any sanitization as the password is simply hashed? If the user was to inject anything malicious via the password textbox, should I bother checking for anything suspicious? AFAIK, some users may (should!) have special characters such as '< >', which would normally trigger a potential attack alert. Should I just leave the password field unsanitized? Limiting input for passwords is a last resort for me, as I feel users should use all sorts of characters in their passwords.

Thanks

Upvotes: 4

Views: 3769

Answers (2)

Eric Petroelje
Eric Petroelje

Reputation: 60498

As long as you are hashing it in your application, you should be OK.

Upvotes: 4

Rubens Farias
Rubens Farias

Reputation: 57936

If you're concerned about SQL Injection attacks, you should start using parametrized queries to interact with your database. As it's a business rule to determine what's valid characters to password, I wouldnt strip anything while my customer don't say so.

All other input should be sanitized, as they could also be displayed on your page output and could lead to XSS attacks.

Upvotes: 3

Related Questions