Storing characters like % and \ in MySQL fields?

Question

I have a function to generate an 11 character salt. This salt can include characters like % which I know is wildcard in SQL and \ which is used for escaping things. Some users are complaining about not being able to log in. Could these characters in their password salt be the problem?

http://www.php.net/manual/en/mysqli.real-escape-string.php – Nir Alfasi Jun 13 '12 at 23:36 — Nir Alfasi, Jun 13 '12 at 23:36

score 1 · Accepted Answer · answered Jun 13 '12 at 23:44

Unequivocally yes. specifically the backslash if it is not done correctly. If you are doing this salting/hashing in mysql only that is a bad idea, i would suggest you perform it in a server side language before storage, and if you are already, you could always sha1 or md5 your hashed result before storage.

Storing characters like % and \ in MySQL fields?

1 Answers1