Don't pass around username and password in plain text all over the place.<BR><BR>2) You do validation like this: <BR>if request.form ('username') = "something that doesnt seem ok" then print out ...