Potential leak of data: Simple Password

Detected 2 occurrence(s) of ‘\s*pass[word]+\s*[:=]\s*["'][a-z0-9\-_\!\$]+["']‘: ); if(mssql_num_rows($results) > 0){ echo "Exists."; } else{ echo "Sorry."; } <input type="text" name="password" value="" /> <input type="password" name="password" value="" /> $sql="SELECT * FROM Accounts WHERE AccountName='$username' AND Password='$password'"; $result = mssql_query($sql); if (mssql_num_rows($query)) { echo 'user exists'; }else{ echo 'user does not exist'; } Source: http://pastebin.com/raw.php?i=wh0bbE0b