title: Using MD5 and Password hash function when storing in database
body: <p>If I have this PHP script for a login system:</p>
  
  <pre><code>    $user = $_POST['user_name'];
      $pass = md5($_POST['user_pass']);
  
      require_once("connection_file.php");
      $sql = "SELECT * FROM login_table WHERE user_n = :us AND user_p = :password";
      $stmt = $conn-&gt;prepare($sql);
      $stmt-&gt;bindValue(':us', $user, PDO::PARAM_STR);
      $stmt-&gt;bindValue(':password', $pass, PDO::PARAM_STR);
      $stmt-&gt;execute();
      $result = $stmt-&gt;fetchAll();
      if($result)
      {
          //echo $msg = "user exist";
          if(session_status() == PHP_SESSION_NONE)
          {
              session_start();
              foreach($result as $row)
              {
                  $hash = password_hash($row['user_pass'], PASSWORD_BCRYPT);
                  if(password_verify($row['user_pass'], $hash))
                  {
                      $_SESSION['userid'] = $row['user_id'];
                      $_SESSION['role'] = $row['user_role'];
                      header("Location: homepage.php");
                  }
              } 
          }
      }
      else
      {
          $msg = "Wrong credentials";
          header("Location: login_page.php");
      }
  </code></pre>
  
  <p>And as you see I am already saving my password in database as <code>MD5</code> and I am using <code>$pass = md5($_POST['user_pass']);</code> to verify if the text input by the user is equal to <code>MD5</code> hash.</p>
  
  <ol>
  <li><p>Now my question is should I use the <code>password_hash</code> and <code>password_verify</code> as I am using in this script ? Or using <code>MD5</code> would be enough ?</p></li>
  <li><p>And my second question is can I save passwords in database using the hash string result or it is okay to use the md5 one?</p></li>
  </ol>