4

Does MySql 5.1 and SQL Server 2008 (Web edition, Standard) have any functional password limitations other than length limits? Are metacharacters in any form a bad idea to use, like bang, pipe, hash, any slash, carrot, and so on?

I know that MySql 5.1 has a password length limitation of 16 characters that is hardcoded, but I was wondering, are any metacharacters (i.e. non alphanumerics) a bad idea to use? And is this true in SQL Server 2008 Web edition, Standard?

So specifically: can symbols like:

/`~>:}{[]^ be used successfully?

I would hope it doesn't matter to the database, but I don't understand enough about password storage in enterprise database systems yet to know for sure, and I was looking for confirmation or an explanation.

2
  • 1
    asteroid: thanks for the kind words. I guess, well, if you don't get a better answer, it'd be cool if you could mark mine down as "accepted" TIA, roland Jan 8, 2010 at 21:47
  • i had a password with a carrot ^ in it and it accepted the password but wouldn't accept it in a connection string Feb 7 at 0:39

4 Answers 4

5

All these characters are good in SQL Server passwords, but the docs to back it up are sketchy.

The MSDN documentation on SQL Server password strength implies that any symbol including whitespace characters is allowed in SQL Server passwords, but if it contains white space it must be delimited in T-SQL statements.

Microsoft SQL Server passwords can contain up to 128 characters, including letters, symbols, and digits. Because logins, user names, roles, and passwords are frequently used in Transact-SQL statements, certain symbols must be enclosed by double quotation marks (") or square brackets ([ ]). Use these delimiters in Transact-SQL statements when the SQL Server login, user, role, or password has the following characteristics:

  • Contains or starts with a space character.

  • Starts with the $ or @ character.

The MSDN documentation on password policy explicitly confirms the following characters are allowed: ! $ # %

And, as you'd already know, the same documentation strongly encourages that you use passwords which are "as long and complex as possible."

0
4
 mysql> create user test identified by '/`~>:}{[]^';
 Query OK, 0 rows affected (0.13 sec)

yes - you can actually login now with this command line:

 C:\Documents and Settings\rbouman2>mysql -utest -h127.0.0.1 -P3351 -p
 Enter password: **********

I tried entering the password directly after -p, but that didn't work for windows - it thinks i want to invoke more if I do that. but I am 100% sure that's on the windows shell. MySQL itself feels this is a valid password.

3
  • succinct and incredibly helpful. thank you! I wonder if anyone knows about this for MSSQL..
    – asteroid
    Jan 8, 2010 at 21:08
  • @Roland, So what's the actual password limit for MySQL server?
    – Pacerier
    Jan 23, 2015 at 14:08
  • @Pacerier as long as you use a clean method (dev.mysql.com/doc/refman/5.7/en/assigning-passwords.html) to assign the password (i.e. not update the mysql.user table directly), I don't think there is any limit, since MySQL stores a hash rather than the actual password. Jan 24, 2015 at 15:16
1

In my experience, it's the backslash \ and the single quote ' that you'll want to avoid in a MySQL password. From my tests, the following special characters appear to be fine to use:

!@#$%^&*:./?=+-_[]{}()<>

Also, 32-character passwords seem to be okay to use, too.

0

Watch out, even though MYSQL may work, your php/http daemon/.htaccess may do some wierdness to the req's before passing them along, I had a password with ( $ and ! in it, and it did NOT work from php-mysql based web page, but DID work from the console... 8 character password. $db_pass = "($JlKl1!"; And what do you know, it fails. change the password to "test" . and bam, it works. Change the password to something ridiculously long, (and entirely devoid of "$" or "!" or "(" ) and it also worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.