Hacker News Reader

This isn’t really significantly more irritating than half the password “rules” forced on me by major companies who ought to know better.

“A special character…” Okay, how about: “

“No, not THAT special!! (Shh, we are worried about a SQL injection attack… in your password… which we dont even know how to escape)”

Let the many implications sink in for a minute.)

View on HN

I once had to deal with an site that would be fine with a ' in the password when setting it, but would throw a mysterious error every time you tried to log in.

For about 2 years I reset my password many times, always to the same one and that would also log me in. I just figured the site was broken for me but this worked and contacting support is rarely helpful for stuff like this so whatever, until it suddenly dawned on me the ' might be the "problem".

It doesn't necessarily mean that they don't know how to escape special characters, it just might mean that they're employing a defence in depth approach.

Reply on news.ycombinator.com