Then would replacing md5() with hash_hmac(&#x27;sha256&#x27; [= or whatever ], strtolower($username) [= data ], strtolower($password) [= key ] ) help against such an attack? If I understand correctly, this would have ruled out rainbow tables.<p>Edit: clarified. BTW hash_hmac is built-in with PHP &gt;= 5.1.2.