note 92179 deleted from function.sleep by danbrown

Note Submitter: lc ---- for marpetr at gmail dot com, about brute force: sleep() won't prevent or hinder brute force attacks on logins, unless you also serialize the login procedude e.g. the attacker starts 1000 login requests simultaneously, your script delay by 1 second each request; the result is that the 1000-login batch gets delayed by only 1 second (not 1000 seconds) bear in mind that php web request are parallel - you have to somehow limit one login request at a time (maybe per username?) until the last one succeded or failed