That's a really bad argument. If password <i>length</i> is threatening to you, you have no business accepting passwords.<p>(Length also has <i>almost</i> nothing to do with SQL Injection, and you're plugging a raw password into an SQL query you're doing something very wrong anyways).