[eluser]SpooF[/eluser]
Huge question here... are you trying to protect the users password, or the information of the user on your site? First of all if they have access to your database (through sql injection) they can simple look at what ever data you have, if not edit it. If they have your code, your just screwed because they can just CHANGE THE HASH. They don't need a rainbow table because they know how the hash is made.
What exactly are we arguing about? I guess it really comes down to how they gained access to your code/database