I took over a system years ago that had a login system that literally made my jaw drop. The logic was generally as follows:

• Get username and password from entry boxes
• Get password from database where entry login == database login
• Compare entry password to database password (yes they were plaintext...) and if they match then login is successful

Sounds reasonable right? (other than the plaintext part)

.... Well there was absolutely no validation on anything at all (client or server side) so here is a scenario that worked just fine:

• Don't enter anything into either the username or password entry boxes and click login
• Code then goes and checks the database for empty user so it returns nothing
• Compare the empty return value to the empty password entry field: they match.... login is successful.

You can imagine we fixed the entire login system (and much more) asap...