Are parametrized calls/sanitization/escaping characters necessary for hashed password fields in SQL queries?

Posted by Computerish on Stack Overflow See other posts from Stack Overflow or by Computerish
Published on 2010-12-31T19:50:26Z Indexed on 2010/12/31 19:54 UTC
Read the original article Hit count: 193

Filed under:
|
|

When writing a login system for a website, it is standard to use some combination of parameterized calls, sanitizing the user input, and/or escaping special characters to prevent SQL injection attacks.

Any good login system, however, should also hash (and possibly salt) every password before it goes into an SQL query, so is it still necessary to worry about SQL injection attacks in passwords? Doesn't a hash completely eliminate any possibility of an SQL injection attack on its own?

© Stack Overflow or respective owner

Related posts about sql

Related posts about passwords