Benefit of using CI - an honest question

In my opinion, the amount of security you need is a function of both the probability of attack and the stakes involved. Do you need SSL? Well, what are the chances that someone might intercept a login attempt? Sites like Amazon or Wells Fargo are attractive, but is yours? And what are the consequences of someone unauthorized hacking into one of your users account?

As for encrypting passwords, sure. It's easy to do and doesn't cost anything. But in my experience of running small websites, the main benefit is that you don't know your users' passwords.

A bigger problem is bot-driven brute-force hack attempts, which can be constant if you use something like Word Press. I've had a WP site with a few photochop tutorial articles online for about a year now. It has no ads and doesn't register anywhere traffic wise. I've not once received a real comment, and yet I get 300-500 megabytes of traffic a month just from bots hammering at my wp-login.php page. I'm getting sick of that, so I'm looking for one of the many ways to limit login attempts, but without the cooperation of my host, those bots will still run up the traffic meter even if they dash themselves against a wall. But if you don't run WP and don't name your login page something obvious, you probably won't experience this.

Anyway, nothing about security has to do with whether or not you should use Codeigniter. I think that, once you're over Codeigniter's very low learning curve, it simplifies web development for anything beyond your basic five-page static website. You might also look into a lightweight CMS like Wolf CMS, which is a personal favorite though I'm not involved in its development in any way.

Hey, don't work without a PHP debugger. Several free IDEs have this features built in. Two are NetBeans and CodeLobster. Without a debugger, it's like you're driving with a blindfold on -- you are going to crash!