[m_eiman]

It prevents you from getting the passwords with an SQL injection attack (or by reading the users.txt or whatever storage is used for the user list), so it does add protection.

[Hexstream]

Ok, I was assuming the attacker had full access to the server.