"Pablo Gosse" <gossep@unbc.ca> writes:
> However, when I connect to this database via a php script, I can enter
> any valid database user, and I can enter anything for the password (or
> leave it blank), and I'm still able to connect.
Sounds like you don't have pg_hba.conf configured to demand password
authentication. See
http://www.postgresql.org/docs/7.4/static/client-authentication.html
regards, tom lane