Eliminate < > as accepted characters in a wordpress password?

1 comment

1. Simple answer:

   Your friend has misinformed you. Restricting these characters in a wordpress password is not something you need to worry about. But as they say “There is no smoke without fire”.

   More background information:

   In your own web-application code, you should always be especially careful whenever you take any data from a user (Whether from a form, a cookie,or a URL) or another external computer system or application. The reason for this is that you want to avoid the values being interpreted as code and not just used as data.

   The issue that has led your friend to worry about the <> characters is called Cross-Site Scripting and is a kind of attack that malicious users can perform to “inject” html or javascript content into your pages. If you accept information from the user that contains these html mark-up characters and re-display it on the same, or another page, then you can cause their html or javascript content to become part of your page. Any javascript content will run with access to the same data as the user that views the page.

   Whenever outside data is read, it sould always be

   • validated : i.e. checked that it looks like the kind of thing you are expecting, and rejected if it doe not.
   • and encoded: i.e. When this data is displayed to back to the user or sent to another part of the system, it is converted to be safe. The type of conversion always depends on how and where the data is being used.

   Please note that the angle-bracket characters are not the only thing to worry about. Please also note that it is well proven that disallowing certain characters (also called “blacklisting”) is never the best way to secure code. It is always safer to state what is allowed (also called “whitelisting”).

   Log in to Reply