mrbool.com
Not escaping user input, storing password in the session. Bad practice all over the place.
Reply on news.ycombinator.com