Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of restrictions:

> 
> Note your password:
> 
> 
> * must be between 6 and 12 characters
> * must not contain spaces, special/international characters
> * must not contain your user name, first name or last name
> * is case-sensitive
> * should contain at least 1 number and 1 letter
> 
> 
> 

I can understand minimum 6 characters, not allowing parts of your name, being case-sensitive, and needing at least 1 number and letter. The part I don't get is restricting your choice of characters you can use, and having an upper bound.

Why do websites do this? The only thing I can think of it they don't know the basics of hashing a password, which would secure it better than anything, and get rid of any security concerns.

If I choose to type `DELETE FROM users WHERE 1=1` as my password, I should be allowed to. PHP's MD5 hash of it becomes `fe5d54132b51b7d65ab89b739b600b4b` which I don't think will harm anything.