Ion Auth不允许使用包含＆符号的密码

Question

I'm developing a bespoke web system for a client using CodeIgniter and Ion Auth. Everything has been going fine so far however I have just come across an issue whereby if I try to set a password with an ampersand in, that user can no longer log in to the system.

At first I thought this issue may be related to character coding as I was setting the passwords manually using a literal string, however the same happens if I take the input directly from a HTML form. I haven't changed any encryption/hash settings in Ion Auth, only the site title, default user group, and the table attribute used for the username.

I'm using CodeIgniter 3 and Ion Auth. Please let me know if you need anymore information.

Any ideas what is happening here?

Answer 1

I've just discovered the issue, and it has made me feel just a little bit daft but I thought I'd let everyone else know the solution because if I've had this issue, I'm sure somebody else is bound to.

The problem was nothing to do with Ion Auth, but instead to with me incorrectly using CodeIgniter functions. To obtain the password from the form, I was using set_value('password) which actually escapes values for HTML as documented here and written about here. Obviously by just printing the password using echo, which was how I was attempting to debug, I couldn't see that the the original string was being altered in any way but it made a difference to the hash.

The solution is to simply use $this->input->post('password') to get the password instead, as this function makes no changes to the original input.

Hope that helps somebody. The moral of the story is to get familiar with any framework before you start using it and read the documentation thoroughly.