When your users register, input their md5(password) into the mlf2_userdata table. The code still supports md5(password) as it appears that an older version of MLF used MD5. Just curious though, why do you need the correct password in that table? My method I showed doesn't require the passwords to be the same as the $_SESSION data is being populated based on users authenticating through my current system, not through MLF.