Is it secure to set default value for password field? I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an activation token.

However, the application has a bug currently, where the DB was set up with the password field NOT NULL, and without default value, which makes INSERTs fail.

If I modify my table structure and set a default value for the password (using some arbitrary encrypted value), admins can add new users and these users are prompted to set a password prior to first login.

My question is - is there a security risk here that I should be aware of?
I see only 2 options to get it to work :


Application inserts value for password field
Table has NULL or default value for password field


If the column allows NULL, that should be enough, right?
If you want it to have a value, having the application insert it, across the network, is probably riskier, than setting a default value in the table.

Setting the same default value for all users may also pose a slight risk (someone gets a hold of the hash and tries to reverse-engineer). If you want to avoid that too, you can use a BEFORE trigger to set a computed default value based on username+timestamp as salt for the encrypted password field.