The latest update of the Access_user Class was focussed on a better security especially while usage on shared web hosts. Philp Olson noticed me about the problem of session storage on most of the shared hosting platforms.
I added to the class an external object which is based on a Zend tutorial, this way it was possible to solve this problem very quick. Further the password strings are encoded after the user has entered his password and submitted the string to the database. Also the password stored in the cookie is md5-encoded now.
I created for the existing user a list of all code updates in as special thread of the Access_user support forum.
You really ought to SHA-1 (or stronger) hash the passwords. MD5 has been shown to have various weaknesses for a while know. My preferred choice is SHA-256.
Right there are more safer hashes then md5() , but it’s only used to encrypt a password, without using a SSL connection a safer hash will not help very much…
I use SHA1 too. It is safer and much faster than anything else.