On your insert record code you should make password into something like $password = sha1($_GET['password']) Then no one can see the plaintext. When you compare the login just wrap the login password with SHA1 and compare the hash to the one stored in the DB an all is good :0)