note 56775 added to function.md5

simpleText, you are wrong. As mina86 said (albeit not very clearly) if your database has been compromised (or the hashed values have been otherwise discovered - e.g. from a temporary session file) then the fact your PHP code expects an ALREADY hashed password means that you will be granting full access to whoever has intercepted your hashes. If somebody has access to the stored password hashes, then they will be able to gain full access to the system simply by sending back the hashed value they have discovered with the random number (which is available in the html source) appended to it. The javascript tells them everything they need to know in order to do this. If instead you sent the password as plaintext across the wire (doing the md5 hashing on the server, as is usual), then having the hashed value would be useless as it cannot be decrypted, and therefore cannot be used to log into the system. So in this instance it is LESS secure to use Paj's function than to send the plaintext password. ---- Manual Page -- http://www.php.net/manual/en/function.md5.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56775 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56775&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56775&report=yes Search -- http://master.php.net/manage/user-notes.php