note 17383 added to function.md5

Re: adding delay to login-page This won't work, since the cracker can fire multiple request concurrently to your webserver. In fact, your solution is the same as a high network-delay from the hacker's point of view. It would work however, if the call to the login-procedure was synchronized, meaning only one login could be active at a time. Still this is no good solution, as you would become vulnerable against DoS-attacks. The delay is more a pain the user's big a (if set to high) instead of the hackers. If you have no synchronization - forget about it! Depending on the users that can access the login and the administrators time, a solution against brute-force might be to mark an account as disabled if login fails multiple times. -- http://www.php.net/manual/en/function.md5.php http://master.php.net/manage/user-notes.php?action=edit+17383 http://master.php.net/manage/user-notes.php?action=delete+17383 http://master.php.net/manage/user-notes.php?action=reject+17383