Is my login function secure ? how to improve it? Using cakePHP, I would love to have your point of view about this large source code, i am not sure if its enought secure. sha1() will be removed with another script. 
I found this large script can be optimized but how ?

i have many times 

$this-&gt;Session-&gt;setFlash("You hav to complete each fiedls", "error");


and

$this-&gt;Request-&gt;redirect(SITE . "users/account");


I wonder if I can optmize this also:

class UsersController extends Controller {
    function account($Req){
        if(isset($Req-&gt;post-&gt;login)){
            $login = addslashes($Req-&gt;post-&gt;login);
            $password = sha1(addslashes($Req-&gt;post-&gt;password));
            $pass_confirm = sha1(addslashes($Req-&gt;post-&gt;pass_confirm));
            $email = addslashes($Req-&gt;post-&gt;email);
            $signature = addslashes($Req-&gt;post-&gt;signature);

            if(empty($login) || empty($email)){
                $this-&gt;Session-&gt;setFlash("You hav to complete each fiedls", "error");
                $this-&gt;Request-&gt;redirect(SITE . "users/account");
            }
            elseif($pass_confirm != $password) {
                $this-&gt;Session-&gt;setFlash("You gave two differents password", "error");
                $Req-&gt;redirect(SITE . "users/account");
            }

            $this-&gt;loadModel("Users");

            $dispoLogin = $this-&gt;Users-&gt;findCount(array(
                "login" =&gt; $login
            ));
            if($dispoLogin === 0){
                $this-&gt;Session-&gt;setFlash("The login is already use by someone else", "error");
                $this-&gt;Request-&gt;redirect(SITE . "users/account");
            }

            $dispoEmail = $this-&gt;Users-&gt;findCount(array(
                "email" =&gt; $email
            ));
            if($dispoEmail === 0){
                $this-&gt;Session-&gt;setFlash("Email adress already use by someone else", "error");
                $this-&gt;Request-&gt;redirect(SITE . "users/account");
            }

            if(empty($password)){
                $q = $this-&gt;Users-&gt;findFirst(array(
                    "fields" =&gt; "password",
                    "conditions" =&gt; array(
                        "id" =&gt; $this-&gt;User-&gt;id
                    )
                ));
                $password = sha1($q-&gt;password);
            }

            $this-&gt;Users-&gt;save(array(
                "id" =&gt; $this-&gt;User-&gt;id,
                "login" =&gt; $login,
                "password" =&gt; $password,
                "email" =&gt; $email,
                "signature" =&gt; $signature
            )); 
            $this-&gt;user-&gt;setData(array(
                "login" =&gt; $login,
                "password" =&gt; $password,
                "email" =&gt; $email,
                "signature" =&gt; $signature
            ));

            $this-&gt;Session-&gt;setFlash("Your profile page is updated");
            $this-&gt;Request-&gt;redirect(SITE);
        }
    }
}
I answered you on SO but I'll repeat it here too.

Please read the CakePHP Documentation, preferably from the start because you really are getting a lot wrong here.


There is no need to addslashes() everything, (or anything ever)
CakePHP has it's own AuthComponent, so no need to roll your own
It also has a validation engine, so no need to validate anything here
You're also passing some Request object to the method? I don't even want to ask...


This action should basically be about 6 lines long. TL;DR: Read the CakePHP Authentication docs, and start again.