PHP : Unsafe password management