Hi there!
To prevent SQL injection, user information is sensitive and space characters are prone to malicious operations such as obtaining user information by using the database features. For example, for a query statement like
strSQL = "SELECT * FROM users WHERE name = '" + userName + "' and pw = '" + passWord + "';". If the user input is as follows:
userName = "1 'OR' 1' = '1'; passWord = "1 'OR' 1' = '1'; the SQL statements are as follows:
strSQL = "SELECT * FROM users WHERE name = '1' OR' 1' = '1' and pw =' 1' = 'OR' 1' = '1';".
Because the WHERE condition is always true, this is equivalent to the execution:
strSQL = "SELECT * FROM users;".
Therefore, you can log in to the website without a password. If the malicious user is worse, enter the following information:
userName = "1"; passWord = "'; DROP TABLE users;".
The SQL statement is changed to:
strSQL = "SELECT * FROM users WHERE name = '1' and pw =' '; DROP TABLE users;".
This way, although there is no login, the data table is deleted. The password can contain special characters because the password is generally encrypted (usually the digest algorithm of MD5).
The password should not be saved in plain text. Not only can the security be improved, but special characters do not need to be restricted.
Because HTML tags are not user-friendly in some places, some characters escape. Therefore, spaces are not recommended for sensitive information.
