Sweet wrote: Also how easy is it to implement the 160bit Encryption of passwords?

I asked myself the same question....

It is easy when you use sql server. password encryption is built in with sql server. so if someone signs up you create the account with a query like the following:
strSQL = "INSERT INTO tblAuthor (Username, [Password]) Values ('"
strSQL = strSQL & Username & "', pwdencrypt('" & strPassword & "')"

I left other fields out. But this function created the password. But one thing you should change is change the field type of the password to binary.

Now when someone logs in you need to compare the clear text password that is submitted by the form with the encrypted value. You could do something like the following:
strSQL =          "Declare @LoginUser varchar(30) "
strSQL = strSQL & "Declare @EncryptedPIN varbinary(255) "
strSQL = strSQL & "Select @LoginUser = (Select Username from tblAuthor where Username = '" & strUsername & "') "
strSQL = strSQL & "Select @EncryptedPIN = (Select [Password] from tblAuthor where Username = @LoginUser) "
strSQL = strSQL & "Select @LoginUser AS Username, pwdCompare('" & strPassword & "', @EncryptedPin, 0) AS Success "
strSQL = strSQL & "FROM tblAuthor where Username = @LoginUser"

Now you just read out the value Success if it is 0 then the login failed if it is 1 it was successful. It works very well for me and you would just have to encrypt existing passwords manually using some code. Hope that helps.