Posted by Gordon Burditt on 01/12/07 01:56

>How would I validate and reply with an error message if 'the right
>username with wrong password' came up? Thanks...

You shouldn't have a different error message for the cases:
right username with the wrong password
vs.
wrong username with any password at all

If you do, you're giving away which usernames are correct.

[Back to original message]