Steve

So what's your point... I should hash every field?

OK guys thanks for the comments, I'll take away what's useful for the site I'm working with and store the others for other work as appropriate.

I understand that, but if it's a non-commercial "help" site, with a login to allow users to store preferences and receive mailshots etc, written by one person with a few hours to spare a month, what is the option?.. close it or put up a notice explaining the dangers of registration?

Irony not appreciated!... not everything needs to be nailed shut, security needs to be appropriate to what is trying to be protected + the budget for any work (zero in this case). We are not talking a commercial system here. To me encryption is better than plain text but not as good as hashing... I repeat, if the backend database is SQL and the attacker gets the passwords from the user table then they have the rest of the data anyway.. or do you guys connect to the users table with one SQL account and then allow access to the rest of the system with another?

We encrypt but using a 2 way approach