note 56775 deleted from function.md5 by mazzanet

Note Submitter: php at REMOVEMEkennel17 dot co dot uk ---- simpleText, you are wrong. As mina86 said (albeit not very clearly) if your database has been compromised (or the hashed values have been otherwise discovered - e.g. from a temporary session file) then the fact your PHP code expects an ALREADY hashed password means that you will be granting full access to whoever has intercepted your hashes. If somebody has access to the stored password hashes, then they will be able to gain full access to the system simply by sending back the hashed value they have discovered with the random number (which is available in the html source) appended to it. The javascript tells them everything they need to know in order to do this. If instead you sent the password as plaintext across the wire (doing the md5 hashing on the server, as is usual), then having the hashed value would be useless as it cannot be decrypted, and therefore cannot be used to log into the system. So in this instance it is LESS secure to use Paj's function than to send the plaintext password.