What are the best practices I should remember while designing the login pages?
• From the login page, the user should be sent to a page for authentication. Once authenticated, the user should be sent to the next page. This is explained in the answer to the next question. • The password should never be sent in clear text (unencrypted) because it can be stolen by sniffing; saving the password in clear text in the database is dangerous too. The best method of sending passwords is the Salted MD5 hashing technique and the passwords should be hashed and then stored in the database. • The best way to manage sessions would be to use one session token with two values during authentication. One value before authentication and one after.
