Originally Posted by raf
idon't understand what you try to say here, but if you're suggesting to only yse the sleep() after xx tries --> isn't gonna work. the cracher will not send any sessionID (not through a sessioncookie, not in the querystring and not in a hidden formfield) to your server so each trie will be considered as the first trie of a new client.
You could force the user to have a session and that the user was on a login page before you let them log-in.
I'm not sure if this was any help, but I hope it didn't make you stupider.
Experience is something you get just after you really need it.
PHP Installation Guide