Hacker News Reader

Does anyone know if using a xss_clean function such as the one in PHP would be a problem for user passwords?

Many people like to use special char for password not sure that will conflict with xss_clean. Thanks!

You would never have to filter a password. In general, you shouldn't rely on filtering, but rather on escaping. Escaping always work, whereas filtering can have subtle edge cases. The only place where you should resort to filtering, is when you (for some reason) need to display input as code. But it's important to stress that filtering is less safe than escaping - it's not the other way around. That's counter-intuitive, so a lot of people get it wrong.

I would not recommend showing a user's password for security reasons. If you do show it thought, then using xss_clean would probably complicate things as it probably removes or escapes some special chars like <, > and &.

Reply on news.ycombinator.com