note 106532 deleted from function.sleep by thiago

Note Submitter: trivia21 at freemail dot hu ---- I don't think simply adding a delay - even both in fail and pass branches - will prevent brute force password attacks. Attackers would still be able to send lots of queries simultaneously, then receive a lots of responses 2 seconds later. Thats not true if a session is started, but cookie based sessions can be avoided by not sending PHPSESSID. Recording the last unsuccesful attempt per user on the server-side seems to be a better idea, but this way attackers can prevent anyone from logging in with the correct password. I'd use captcha against that.