Database password with MD5

[eluser]WanWizard[/eluser]
Passwords should always be hashed (= one way process), not encrypted.

The most secure way to hash at the moment is using bcrypt or pbkdf2, and combine the password with a random salt for added security.

Ideally a per-user salt, even more ideally regenerated after each login, but if not possible a generic salt stored in a config file or a settings table (or combine the two).