diff --git a/src/views/register.vue b/src/views/register.vue
index 7f078c1..99ca62f 100644
--- a/src/views/register.vue
+++ b/src/views/register.vue
@@ -91,7 +91,8 @@ const registerRules: ElFormRules = {
   ],
   password: [
     { required: true, trigger: 'blur', message: '请输入您的密码' },
-    { min: 5, max: 20, message: '用户密码长度必须介于 5 和 20 之间', trigger: 'blur' }
+    { min: 5, max: 20, message: '用户密码长度必须介于 5 和 20 之间', trigger: 'blur' },
+    { pattern: /^[^<>"'|\\]+$/, message: "不能包含非法字符：< > \" ' \\\ |", trigger: "blur" }
   ],
   confirmPassword: [
     { required: true, trigger: 'blur', message: '请再次输入您的密码' },
diff --git a/src/views/system/user/index.vue b/src/views/system/user/index.vue
index 3ea2864..dfbd789 100644
--- a/src/views/system/user/index.vue
+++ b/src/views/system/user/index.vue
@@ -395,7 +395,8 @@ const initData: PageData<UserForm, UserQuery> = {
         max: 20,
         message: '用户密码长度必须介于 5 和 20 之间',
         trigger: 'blur'
-      }
+      },
+      { pattern: /^[^<>"'|\\]+$/, message: "不能包含非法字符：< > \" ' \\\ |", trigger: "blur" }
     ],
     email: [
       {
@@ -504,7 +505,12 @@ const handleResetPwd = async (row: UserVO) => {
       cancelButtonText: '取消',
       closeOnClickModal: false,
       inputPattern: /^.{5,20}$/,
-      inputErrorMessage: '用户密码长度必须介于 5 和 20 之间'
+      inputErrorMessage: '用户密码长度必须介于 5 和 20 之间',
+      inputValidator: (value) => {
+        if (/<|>|"|'|\||\\/.test(value)) {
+          return "不能包含非法字符：< > \" ' \\\ |"
+        }
+      }
     })
   );
   if (!err && res) {
diff --git a/src/views/system/user/profile/resetPwd.vue b/src/views/system/user/profile/resetPwd.vue
index 0a39fb1..6d536da 100644
--- a/src/views/system/user/profile/resetPwd.vue
+++ b/src/views/system/user/profile/resetPwd.vue
@@ -44,7 +44,8 @@ const rules = ref({
       max: 20,
       message: '长度在 6 到 20 个字符',
       trigger: 'blur'
-    }
+    },
+    { pattern: /^[^<>"'|\\]+$/, message: "不能包含非法字符：< > \" ' \\\ |", trigger: "blur" }
   ],
   confirmPassword: [
     { required: true, message: '确认密码不能为空', trigger: 'blur' },