We no longer hardcode connection strings (like "db main") into the source code. We use environment variables to keep credentials secret.

hash = MD5(Request.Form("password") & salt) SQL = "UPDATE users SET password = '" & hash & "' WHERE username = '" & user & "'"