It had simply been some time since I had worked with MySQL. I didn't fully understand prepared statments when I began creating the site (as I had never worked

It had simply been some time since I had worked with MySQL. I didn't fully understand prepared statments when I began creating the site (as I had never worked with them before), so I put in a check to make sure that nobody was trying to inject anything via SQL when registering, but I realize that is all for nothing now when using prepared statements. Every user's password is hashed using the default PHP 'PASSWORD_DEFAULT', which according to this page uses BCRYPT: http://www.php.net/manual/en/password.constants.php http://www.php.net/manual/en/password.constants.php Needless to say, I have removed the password restrictions... now the only restriction is that it must be at least 6 characters in length, and must be no more than 5,000 characters in length. You should be able to use any kind of crazy UTF8 combination of characters you can muster. Not only that, but attackers are limited to 3 attempts per IP per hour when trying to log in via brute force.