MD5'ing Passwords

[Fishpotman]

Hi

I'm looking to write a uid/pass login page (done and working),
but 1 thing I keep coming across is md5'ing passwords for
database storage.

I have a few questions regarding this topic:-

1) How do you change the hash back into a password i.e. password recovery (thought md5 was 1 way incrypt)?

2) Why md5 a password if you have to have a plain text version in the database for password recovery?

3) Is it the case that I will need to write a script to change the password instead of mailing the password to the users supplied e-mail address?

TIA
Steve

[su1d]

1. You don't have to change it back to the plain text pass. When you get a user's input, you MD5 it and compare with what you have in DB. If two hashes are equal, authentication is OK.

2. There's no password recovery with MD5. The system generates a new password and sends it to the user's registered email address.

3. Exactly.