Fort Knox level account protection here

HackShield protects from pasting in MS; so you could 1. packet edit; 2. strip hackshield (and then you won't get past charselect); 3. modify the textbox value using a undetected cheat engine (since HackShield aka FalsePositiveShield), though this is very hard

Then again if the hackers still have write access to the DB, they can just modify the password directly.

MSSQL sucks.