Make sure that the password is protected from injection (SQL, PHP, whatever you can inject). If it isn't sanitized, sanitize it.