Login Controller/Model

[eluser]tonanbarbarian[/eluser]
You should always store passwords hashed
either md5 or some other function like sha1

If the password is stored in plain text then any SQL injection attack could be used to retrieve the password if you are not careful.

Also you might want to salt the password before you store it, and check it. Salting also helps with other exploits.
Some hackers will use an SQL injection attack to get the password hash, and then they will use online tools to see if they can determine a valid password that matches the hash, or they will try a brute force system to look for valid plain text that matches the hash.

If you are not aware there could theoretically be multiple strings that match any given hash.
The MD5 hash of the letter 'a' => 0cc175b9c0f1b6a831c399e269772661 could also be the same hash as the entire works of Willian Shakespear. It probably isnt but it is possible.

To salt the password you have a config option that is the salt string.
You then add the salt to the plain text before you encrypt
i.e.

$hash = md5($this->config->item('password_salt').$password);