Are you storing the passwords encrypted, hased, hased with salt, or plain text? How is the password being passed to the login procedure as well?