I've gotta ask, why are you making your users enter IDs directly? Wouldn't a username and password be both more secure and easier to implement (you could just use standard auth and session modules, for example). Consider that by making your users enter a long number you're basically forcing them to write it down somewhere.