What precaustions should be taken when the file displayed by a webpage is specified by the GET value I'm open to any ideas so let's talk about the database. Are you saying to make a database so that when the value for GET is abc (i.e. navigate.php?d=abc) the database would map abc to firstpage.html? Or would it make more sense to have stored in the database a list of viewable pages and if the GET value (i.e. firstpage.html) isn't on the list the page is not displayed?
Avoiding Brute Force Attacks in a Web Based Login Form Your #2 sounds very similar to what my initial idea was. Is the difference that each script that is sleeping uses server resources but blocking an IP address doesn't really use resources?