Why no password sanitization?

[Manaus]

Hello,

I've seen from different forum posts that the password field is never sanitized. Isn't it subject to malicious code?

Thanks!

[horst]

http://processwire.com/talk/topic/3543-register-users-and-add-page-same-as-username/#entry34854

The password is actually one thing (and probably the only thing) that you really shouldn't sanitize, because you don't want to change the password they entered. What you should do instead is validate it, making sure that it's a string with some length and at least [n] characters (whatever your requirements are). By validate vs. sanitize, I mean don't sanitize (clean) what they entered, but give them an error and make them enter something new if it doesn't validate.

Edited February 21, 2014 by horst

[Soma]

It is validated and sanitized and throwing error.. But I think its not good if you create own registration and sanitize it before storing as you would end up with different password if you don't take care of showing a error to the user.