- no salt in the hash
- no session setup which means index.php could be accessed without this page
- no CSRF verification for the form
- no separation of code and presentation

— Antoni Goldstein 🇵🇱 (@AntekGoldstein) August 19, 2022