grinder is correct. Anonymous Monk is, too. Be afraid. Be very afraid. One additional thing to consider is to check the usernames for validity. You do not want a user asking for the name evil::0:0: (of course, the 'name' doesn't matter).

Do the people really need full accounts? Can you create web-accounts (e.g. using htpasswd/.htaccess in Apache)?

BTW, using folders in /home is not a correct algorithm: at least root does not have a home directory there.

HTH, --traveler