Password Algorithim?

From login.php:

if (!empty($db_password_hash))
    {
        $sha1_in_db = (strlen($db_password_hash) == 40) ? true : false;
        $sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false;

        $form_password_hash = pun_hash($form_password);    // This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available)

        if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash)
            $authorized = true;
        else if (!$sha1_in_db && $db_password_hash == md5($form_password))
        {
            $authorized = true;

            if ($sha1_available)    // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
                $db->query('UPDATE '.$db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $db->error());
        }
    }

Ah, thanks a lot.

Well, in order for PHP or anyother program to read MD5, it has to decrypt it. So therefore, it has already been done.

For some odd reason, I feel that I am that someone that Dale is refering to. Weird.... I would NEVER do something like that...

No program reads the MD5.
They just take the text password you supply, turn it into MD5 and compare it to the MD5 value that you store in the DB/file.

Hello,

I don't understand very well why in PHP there is this 2 lines :

            if ($sha1_available)    // There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
                $db->query('UPDATE '.$db->prefix.'users SET password=\''.$form_password_hash.'\' WHERE id='.$user_id) or error('Unable to update user password', __FILE__, __LINE__, $db->error());
        }

(if the login is successfull).

It is designed to convert md5 passwords to sha1, that's ok, but why are those lines in login.php ? Does this update must be done on every login step ? I would have said that it has just to be done one time (admin maintenance operation).
About this conversion I too have "conceptual" difficulties with this on-the-fly conversion (I had troubles with this to use PEAR:Auth (which doesn't handle sha1, just crypt() and md5()) with punBB), wouldn't it be preferable to have this outside login.php ?

I have just converted from phpBB to punBB and i use some scripts that integrate some other sites with the forum. i have a scripts that copy all users, passwords and their email-adresses and update the other sites databases. They all use MD5 encryption for the passwords.

Is it possible to change something in the code for punBB that makes it store the password as MD5 the next time the user changes the password? Then my scipts will continue to work without modification.