if the username/password are correct the script ends normally. otherwise the script waits for a second before requesting the username/password again. this will slow down a brute force hack trying every possible username/password.
the attacker could make multiple requests and try multiple combinations at a time, but each connection would require at least a second before the attacker would know if it suceeded. if you're using sessions there are better ways to prevent hacks such as this. logging every connection attempt and only allowing so many connections in a certain period of time from the same ip address can also slow down an attack.
