note 52831 deleted from function.mysql-real-escape-string by aidan

Note Submitter: mels at xs4all dot nl ---- @ludvig dot ericson at gmail dot com: I don't see why you wouldn't *especially* escape a password. It should be either *essential* or *useless* to escape a password. Depends on the way you allow NEW registrations. When you escape all NEW passwords too before putting them in the DB, you NEED to escape before calculating the md5 to compare to the md5 in the database. When you filter for any "illegal" characers (which is WAY better IMO) in any NEW passwords before storing them, you are sure you don't have to escape to get a correct match. It is preferrable to ban he chars this function would escape from any new passwords, to make password rememberability greater and overall it's just handier to work with data you are already sure of not having to escape (may sound dangerous, but if your registration script is solid, the data is, period.). It also helps users feel like "hey, there's been thought about this" (although it may annoy at first, they'll appreciate) when their password is refused. Be sure to give them a good explanation (bad rememberability, coder's laziness, etc... :))