How Can I Improve/Secure My Login Script? This is a simple login script. Thought I'm not sure when it's appropriate to use includes over just embedding the code. I'm also not sure if I should make cookies, but I guess I don't really need to right now. Also looking at my code would it be easy to create a 'Remember Me' function? 

&lt;?php
$validUser;
$validPass;
$win;
if($_POST)
{
include('admin/functions.php');
// Database Connection
AllYourBase();

if(CheckEmpty($_POST['username']))
{
    $username = $_POST['username'];
    $validUser = true;
}
else
    $validUser = false;

if(CheckEmpty($_POST['password']))
{
    $password = $_POST['password'];
    $validPass = true;
}
else
    $validPass = false;

$query = mysql_query(sprintf("SELECT * FROM Users WHERE username = '%s'", 
                mysql_real_escape_string($username))) or die(exit());
$result = mysql_fetch_assoc($query);

// Split the Salt
$fs = substr($result['salt'], 0, 10);
$ls = substr($result['salt'], -10);

// Add The Salt
$pass = md5($fs.$password.$ls); 
$name = $result['fname']. ' ' . $result['lname'];

// Authenticate 
if($result['password'] == $pass)
{
    session_start();
    $_SESSION['name'] = $name;
    $_SESSION['auth'] = true;
    $win = true;
    // Javascript Redirect not Header()
    Redirect('index.php');
}
else
    $win = false;
}
?&gt;

&lt;html&gt;
&lt;head&gt;

&lt;/head&gt;
&lt;body&gt;
&lt;form action="&lt;?php echo $_SERVER['PHP_SELF'] ?&gt;" method="POST"&gt;
    &lt;?php if($_POST &amp;&amp; $win == false): ?&gt;
        &lt;div class="error"&gt;Login Unsuccessful&lt;/div&gt;
    &lt;?php endif ?&gt;
        &lt;input type="text" size="10" name="username" /&gt;&lt;br /&gt;
    &lt;?php if($_POST &amp;&amp; $validUser == false): ?&gt;
        &lt;div class="error"&gt;Empty Username&lt;/div&gt;
    &lt;?php endif ?&gt;
        &lt;input type="password" size="10" name="password" /&gt;&lt;br /&gt;
    &lt;?php if($_POST &amp;&amp; $validPass == false): ?&gt;
        &lt;div class="error"&gt;Empty Password&lt;/div&gt;
    &lt;?php endif ?&gt;
    &lt;input type="submit" text="Submit" /&gt;
&lt;/form&gt;
&lt;a href="register.php"&gt;Registration Page&lt;/a&gt;
&lt;/body&gt;
&lt;/html&gt;
Rather than an else statement to set false on invalid username/password why not just default to false and only set to true if it worked. Also do you care unless both are valid?

$validUserAndPassword  = false;

if (CheckEmpty($_POST['username']) &amp;&amp; CheckEmpty($_POST['password']))
{
    $username = $_POST['username'];
    $password = $_POST['password'];
    $validUserAndPassword = true;
}


The DB is an expensive resources. There is no point in connecting to the DB or even getting stuff from the DB unless you have a valid username and password.

$ result = array();
if ($validUserAndPassword)
{
    AllYourBase();

    $query = mysql_query(sprintf("SELECT * FROM Users WHERE username = '%s'", 
                mysql_real_escape_string($username))) or die(exit());
    $result = mysql_fetch_assoc($query);
}


I am pretty sure that splitting the salt provides little extra entropy.

// Split the Salt
$fs = substr($result['salt'], 0, 10);
$ls = substr($result['salt'], -10);

// Add The Salt
$pass = md5($fs.$password.$ls); 


I think doing authentication your self is a bad idea (this is a specialized field with lots of gotchas). Anway don't you want to spend time on your application rather than doing mundane tasks like authentication?

I am not an expert on front-ends so I have no good recommendations on packages that can do it for you. But I did play around with openid-selector (available via google source), which is the same authentication package that the stack exchange sites use. This allows the users to login-in to your site using the open-id credentials (google/open-id/facebook/yahoo/stack-exchange)).