title: CodeIgniter 2.1.0, jQuery: Login Security questions
body: <p>I have a website where I do the following in order to let people log in:</p>
  
  <p><strong>jQuery:</strong> - using the $.md5() plugin and the $.cookie() plugin (for CodeIgniter CSRF protection cookie for post data)</p>
  
  <pre><code>$('#login').on('submit', function(e){
    e.preventDefault();
    $.get('/salt/', function(salt){
    // get / set salt and salt flashdata
      $.post('/login/', {
        'username' : $('#l_username').val(),
        'password' : $.md5('' + salt['m'] + $.md5($('#l_password').val()) + salt['s']),
        //set to string (in case MD5 hash of password is an integer)hash password, add salt, hash salted password. 
        '_token' : $.cookie('_cookie')
      }, function(r){
        // *r* == 0: unknown user; 1: wrong password; 2: logged in; 3: database error; 4: session error;
        // perform action depending on *r* value
      })
    })
  });
  </code></pre>
  
  <p><strong>PHP (CodeIgniter):</strong> - rout file forwards <code>/salt/</code> and <code>/login/</code> to <code>/process/salt/</code> and <code>/process/login/</code> - 'session' class is autoloaded</p>
  
  <pre><code>class Process extends CI_Controller {
  
    public function __construct() {
      parent::__construct();
      $this-&gt;load-&gt;model('login'); // loads model with login functions ()
    }
  
    public function login() {
      $data = array();
      $data['username'] = $this-&gt;input-&gt;post('username');
      $data['password'] = $this-&gt;input-&gt;post('password');
      if ($data['username'] &amp;&amp; $data['password']) {
      //if user and password are set
        $user = $this-&gt;login-&gt;getUser($data['username']);
        if ($user-&gt;num_rows() === 1) {
        // if the username is in the database
          $user = $user-&gt;row();
          $salt = $this-&gt;session-&gt;flashdata('s');
          //flashdata set by ajax call to '/salt/'
          $pass = $salt-&gt;m . $user-&gt;password . $salt-&gt;s;
          //password is already hashed in database
          if ($data['password'] === $pass){
            // update logged_in database table then set login session
            echo 2; // logged in; if database / session error, echo 3 / 4
          } else {
            echo 1; // wrong password
          }
        } else {
          echo 0; //unknown user
            }
      }
    }
  
    public function salt() {
      // set salt values based in minute and second time
      $salt = (object) array('m' =&gt; intval(date('i')), 's' =&gt; intval(date('s')));
      //intval() removes leading 0
      $this-&gt;session-&gt;set_flashdata('s', $salt);
      // flashdata only valid for the next server request (which is the login);
      header('Content-type: application/json');
      //return value as json string
      echo json_encode($salt);
    }
  }
  </code></pre>
  
  <p>My question is this: exactly how secure is this log in method? Are there any potential loopholes in the script? I want to make sure that the log in process is as secure as possible without https for the moment.</p>