What decoded challenges for username and password in AUTH=LOGIN can I expect in the real world?
Anything. Unfortunately. So the only validation that you can do is syntax checking and that it's non-empty.
-- Mark --
http://staff.washington.edu/mrc Science does not emerge from voting, party politics, or public debate. Si vis pacem, para bellum.
