There seems to be a fair amount of paranoia in your code: function salt() { mt_srand(microtime(true)*100000 + memory_get_usage(true)); return md5(uniqid(mt_rand(), true)); } here `mt_srand(microtime(true)*100000 + memory_get_usage(true));` is unused. If you consider using it, you should simplify it, you don't get a better salt that way. $password = sha1(sha1($_POST['password'] . $salt)); Here you hash the password + salt twice. That [doesn't provide for any more security][1], than simply hashing it once. Not to mention that your salt is already hashed, which is also redundant. And what's with the individual salts? That's actually not a very good idea, you shouldn't store the hashed password and the salt in the same storage. If someone get's access to your database, she has everything she needs for a common brute force attack. It would be a little more secure if you simply had a variable somewhere with a common salt for every password. Although [I'm not advocating security through obscurity][2], separating hash from salt would be saner. if (strlen($_POST['username']) < 3 || strlen($_POST['username']) > 20) It would be better to do something like: $lengthUsername = $_POST['username']; if (lengthUsername < 3 || lengthUsername > 20) { to not call the function twice. The performance issue is minuscule, but you [should avoid repeating code][3] anyway. The `if (isset($_POST['submit'])) { ... }` is too long. You could move some of the functionality (let's say the database stuff) into a function and just call the function in the `if` block. > What I can do about the func.php file as a file with just a bunch of functions, doesn't seem to be the best approach for it. It depends. If you use everything that's in it everywhere, then it's ok. If not you should brake it to smaller function collection files and include as needed. But since you are doing this the procedural way, it's ok to have one or more function collections. Have you considered an OO approach? I'm not saying you should, just curious. Other than that, your code looks fine. Kudos for using PDO and prepared statements, that's a wise decision. Also good that you are calling `exit` after `location()`, `location()` will fail with a notice if headers already sent. --- As for the update: - Why sleep at all? - The code is fairly small, it would be an overkill to rewrite in OO Unless you already have a User model, in which case you could just add the functionality there: class User { function usernameExists($username) { $username = trim(strtolower($username); $usernames = $this->getUsernames(); foreach($users as $user) { if(strtolower($user) == $request) { return false } } return true; } function getUsernames() { // return list of usernames from db } } and you would call in in the ajax script as: include("User.php"); $user = new User(); if($user->usernameExists($_REQUEST['username'])) { echo "false"; exit; } echo "true" The code is a lot more than with the procedural style, but you can use `User::usernameExists()` everywhere now, if you need it. Also note that I've pushed `strtolower` into the class, if you use it elsewhere such comparison normalizations and possible validations should be in the class method not in the calling code. [1]: http://crypto.stackexchange.com/questions/779/hashing-or-encrypting-twice-to-increase-security [2]: https://softwareengineering.stackexchange.com/a/121629/25936 [3]: http://en.wikipedia.org/wiki/Don%27t_repeat_yourself