使用 MD5 更改密码表格？

Question

I have the php code for changing user password. but after I tried the code... when submitting the new password.. the new password became revealed in the sql database... I want it to be in md5 code password. can you please fix the problem with my code

if($_REQUEST['do'] == 'edit')
{
        $title = 'change password';
        $page  = $_POST['page'];
        $userId = safe($_POST['userId']);
        $passwd = safe($_POST['password']);
        $email  = safe($_POST['Email']);
        $passw2 = $_POST['password2'];

        if(md5($passwd) == $_SESSION['user']['password'])
        {
            if(empty($passw2))
            {
                $pass = $_SESSION['user']['password'];
            }
            else
            {
                $pass = $passw2;
            }
            $query = $db->query("UPDATE users SET email = '".$email."' , password = '".$pass."' WHERE Id = '".$userId."' ");
            if($query)
            {
                $msg = "password changed successfully";
            }

Answer 1

Replace

$pass = $passw2;

with

$pass = hash('md5', $passw2);

Answer 2

The $_SESSION['user']['password'] is (is suppoused) encoded as MD5 but the passw2 fetched from the user form is plain.

you need to change

$pass = $passw2; 

by

$pass = md5($passw2);

to enconde as md5 the password before submit it to the database. And also change the $_SESSION['user']['password'] with the new password or the user can change only one time the password in the same session.