Anecdata about the username guessing - some 10 years ago while investigating a second order sql injection incident I saw exactly the same pattern. Attackers go

Anecdata about the username guessing - some 10 years ago while investigating a second order sql injection incident I saw exactly the same pattern. Attackers got the passwords but not the usernames. Turns out the stored input had a character limit and the project stored fields as 'username' and 'pass'. Since 'pass' was shorter the attackers were able to squeeze it in a short query, but couldn't get usernames. Looking at https://main.php.net/login.php https://main.php.net/login.php it's 'user' and 'pw' in the form, assuming the db fields match.