Quote Originally Posted by Slartarama View Post
That is what the author was saying, that by using MD5() on the username and password, that it was doing the filtering, which is why there could be no SQL injection.
Wrong.

I don't know if it sounds kosher to me, but it seems that encrypting the username and password fields would actually work, I don't know.
Unless you add your own salt...

All its going to do is slow people down from one defacement per thirty seconds to one defacement every thirty minutes. At that point, either way you've got little pink kittens dancing on your homepage.