Quote from: spinoff on December 07, 2013, 09:08:13 AM

Trying to register on lmb-holdings I get this:

Code:

A password may not contain ", ', >, <, or any spaces

why? what are you doing with the password that doesn't permit having those characters in?

Also, I don't like it that Havelock->lmb-holdings transfer has a fee. I've been a shareholder since day 1, and if lmb-holdings was avaible then I would have surely preferred it over Havelock. You should at least provide a "first time free" transfer like you do for the other way around

While not the only method, disabling those characters is a relatively easy way to stop exploits such as SQL injection. Your password is taken in by the server and by using these symbols one could "break out" and execute malicious code. Some examples (which only work on insecure websites):

Login ID: -Anyone I want to hack-
Password: - ' OR 0 == 0 ' -

Input Field:

The first example would make it so any password would work. The quote at the beginning "breaks" out of the password string, sets the boolean quantifier to true since 0 equals 0, then finishes off the remaining quotes so there is no error.

The second example is showing how <> codes can also "break out" and be used to execute code. In that example it is running "ls" which would make the website print out all of folders in that directory. If that worked it would be trivial to keep using ../ to find what you're looking for.

These are just two examples of hundreds of known common exploits, so while there are other methods it is perfectly sensible to block these characters.