Uber-simple login script...

[eluser]Tim Skoch[/eluser]
Thanks!

The JavaScript idea sounds fun.

I don't understand how someone could tamper with a $_SESSION[] variable, though. When PHP uses sessions, the only thing it sends to the user is their session ID - it stores all of the data on the server (at least that's what I understood - but I've been wrong before!). Hence, all they could POTENTIALLY do is spoof a session which wasn't theirs. But I don't think they can inject arbitrary data into the $_SERVER variables.

Anyway, thanks for the input! :-)