partial - any code that duplicates between index and show
always starts with underscore

dont think about IF your site gets hacked, think WHEN your site gets hacked.

never store a password that isnt encrypted

encryption is usually possible, just make it hard enough that it isnt worth someones time
authenticate - make sure you are who you say you are
authorization - given permission