Return to Answer

Here you hash the password + salt twice. That doesn't provide for any more security, than simply hashing it once. Not to mention that your salt is already hashed, which is also redundant.

Here you hash the password + salt twice. That doesn't provide for any more security, than simply hashing it once. Not to mention that your salt is already hashed, which is also redundant.

And what's with the individual salts? That's actually not a very good idea, you shouldn't store the hashed password and the salt in the same storage. If someone get's access to your database, she has everything she needs for a common brute force attack. It would be a little more secure if you simply had a variable somewhere with a common salt for every password. Although I'm not advocating security through obscurity, separating hash from salt would be saner.

And what's with the individual salts? That's actually not a very good idea, you shouldn't store the hashed password and the salt in the same storage. If someone get's access to your database, she has everything she needs for a common brute force attack. It would be a little more secure if you simply had a variable somewhere with a common salt for every password. Although I'm not advocating security through obscurity, separating hash from salt would be saner.

As for the update:

• Why sleep at all?
• The code is fairly small, it would be an overkill to rewrite in OO

Unless you already have a User model, in which case you could just add the functionality there:

class User {

    function usernameExists($username) {
        $username  = trim(strtolower($username);        
        $usernames = $this->getUsernames();
                
        foreach($users as $user) {
            if(strtolower($user) == $request) {
                return false
            }
        }
        
        return true;
    }
    
    function getUsernames() {
        // return list of usernames from db
    }

}

and you would call in in the ajax script as:

include("User.php");

$user = new User();

if($user->usernameExists($_REQUEST['username'])) {
    echo "false";
    exit;
}

echo "true"

The code is a lot more than with the procedural style, but you can use User::usernameExists() everywhere now, if you need it. Also note that I've pushed strtolower into the class, if you use it elsewhere such comparison normalizations and possible validations should be in the class method not in the calling code.