note 106532 added to function.sleep

I don't think simply adding a delay - even both in fail and pass branches - will prevent brute force password attacks. Attackers would still be able to send lots of queries simultaneously, then receive a lots of responses 2 seconds later. Thats not true if a session is started, but cookie based sessions can be avoided by not sending PHPSESSID. Recording the last unsuccesful attempt per user on the server-side seems to be a better idea, but this way attackers can prevent anyone from logging in with the correct password. I'd use captcha against that. ---- Server IP: 69.147.83.197 Probable Submitter: 81.182.4.162 ---- Manual Page -- http://www.php.net/manual/en/function.sleep.php Edit -- https://master.php.net/note/edit/106532 Del: integrated -- https://master.php.net/note/delete/106532/integrated Del: useless -- https://master.php.net/note/delete/106532/useless Del: bad code -- https://master.php.net/note/delete/106532/bad+code Del: spam -- https://master.php.net/note/delete/106532/spam Del: non-english -- https://master.php.net/note/delete/106532/non-english Del: in docs -- https://master.php.net/note/delete/106532/in+docs Del: other reasons-- https://master.php.net/note/delete/106532 Reject -- https://master.php.net/note/reject/106532 Search -- https://master.php.net/manage/user-notes.php