Very good tut. I don't usually register to sites, but after finding this one on pixel2life I felt like I wanted to respond, so now you have a new member. I too read the other tutorial found there about encrypting your strings with a ton of md5's and sha1's and did a legit spit take all over my monitor. Don't worry, it's clean now. The way I do my salts is I concatenate the timestamp from when they registered to their password. Before reading this I would do 2 queries, one to get the timestamp, then concat, md5, then another query to check against the hashed password in the database. Now thanks to this tut, I know that you can md5 something right in your query. Strange I've never come across that before in any of my books or other tutorials, so thank you very much, you saved me 1 query and a couple of micro seconds, which is always a plus. Keep up the good work.