SQL Antipatterns, Volume 1

Antipattern: Store Password in Plain Text

The frequent mistake in these kinds of password-recovery solutions is that the application allows the user to request an email containing their password in clear text. This is a dire security flaw related to the database design, and it leads to several security risks that could allow unauthorized people to gain privileged access to the application.

Let’s explore these risks in the following sections, assuming our example bug-tracking database has a table Accounts, where each user’s account is stored as a row in this table.

Storing Passwords

A password is typically stored in the Accounts table as a string attribute column:

Passwords/anti/create-table.sql

​CREATE​ ​TABLE​ Accounts ( ...