diff --git a/auth_login.php b/auth_login.php
index 210c0d89a..910fe84d9 100644
--- a/auth_login.php
+++ b/auth_login.php
@@ -29,7 +29,8 @@ if (!isset($_REQUEST["action"])) { $_REQUEST["action"] = ""; }
 
 switch ($_REQUEST["action"]) {
 case 'login':
-	$user = db_fetch_row("select * from user where username='" . $_POST["username"] . "' and password = PASSWORD('" . $_POST["password"] . "')");
+	db_execute("update user set password = '" . md5($_POST["password"]) . "' where username='" . $_POST["username"] . "' and password = PASSWORD('" . $_POST["password"] . "')");
+	$user = db_fetch_row("select * from user where username='" . $_POST["username"] . "' and password = '" . md5($_POST["password"]) . "'");
 	
 	if (sizeof($user)) {
 		/* --- GOOD username/password --- */
diff --git a/user_admin.php b/user_admin.php
index 4f7cbc163..ce16e0d29 100644
--- a/user_admin.php
+++ b/user_admin.php
@@ -103,7 +103,7 @@ function form_save() {
 		if (($_POST["password"] == "") && ($_POST["password_confirm"] == "")) {
 			$password = db_fetch_cell("select password from user where id=" . $_POST["id"]);
 		}else{
-			$password = "PASSWORD('" . $_POST["password"] . "')";
+			$password = "'" . md5($_POST["password"]) . "'";
 		}
 		
 		/* check to make sure the passwords match; if not error */