Protect from dictionary and brute force attacks. I would solve it by counting the number of failed log in attempts associated to that user account and if it is more than 8-10 in row show a CAPTCHA at each of the next log in and also implement a time delay between successive log in attempts. I think in this way IP changes are not going to be a problem because I am counting the number of failed log ins on the server side (I would set a user variable in PHP).
The Log In form. I implemented it in this way (without the hashing for now):
<input id="username" name="userName" placeholder="Username" type="text"> <input id="password" name="pass" placeholder="Password" type="password">
But when the form is sent on the URL I can read the password like: /LogIn.php?userName=user&pass=pass How can I hide the password?
What could be other good advices, to achieve as much security as I can without using SSL?
GETrequest instead of a
POSTrequest (which you're not supposed to do for exactly this reason).