I'd prefer to use strlen() to check the length and ctype_xdigit() to check that all the characters are hex. (That of course is assuming that the hash is represented as an ASCII-encoded hex string and not as, say, sixteen bytes.)
Of course, all that will tell you is that the string is 32-characters long and consists entirely of hex. '00000000000000000000000000000000' would pass. Whether the string actually is the MD5 hash of something is another matter (I'm guessing it almost certainly is, but good luck finding out what of!)