Comments by DrWheetos (Top 1 by date)

Don't use the username and password without sanitizing it first to remove characters deemed to be invalid. This code is so unbelievably insecure. It would be trivial to do a sql injection attack on it. Go google it if you don't know what that means. And as barneyman says, hash the password before comparing it against the database. I cringe when I see this stuff.