@@ -87,7 +87,7 @@ $confirm = isset($_GET['confirm']) ? $_GET['confirm'] : false;

 			mt_srand((double)microtime() * 1000000);

 			$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';

 			$pass = random_string($charset, 10);

-			$encryppass = md5($pass);

+			$encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);

 			//$headers = "From: $sitename\n";

 			dbquery("UPDATE "._AUTHORTABLE." SET "._PASSWORDFIELD." = '$encryppass' WHERE uid = '".$_GET['release']."'");

@@ -192,7 +192,7 @@ switch ($_GET['step'])

 			if ((!$_POST['email']) && !isADMIN) $fail .= "<div style='text-align: center;'>" . _EMAILREQUIRED . " " . _TRYAGAIN . "</div>";

 			if ($penname && !preg_match("!^[a-z0-9_ ]{3,30}$!i", $penname)) $fail = "<div style='text-align: center;'>" . _BADUSERNAME . " " . _TRYAGAIN . "</div>";

 			if (!preg_match("/^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9.-]+$/", $_POST['email'])) $fail = "<div style='text-align: center;'>" . _INVALIDEMAIL . " " . _TRYAGAIN . "</div>";

-			if ($_POST['password'] == $_POST['password2']) $encryptpassword = md5($_POST['password']);

+			if ($_POST['password'] == $_POST['password2']) $encryptpassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);

 			else $fail =  write_message(_PASSWORDTWICE);

 			if (!isset($fail))

 			{

@@ -531,7 +531,7 @@ CREATE TABLE IF NOT EXISTS `" . $tableprefix . "fanfiction_authorprefs` (

   `image` varchar(200) NOT NULL default '',

   `date`int(10) unsigned NOT NULL default '0',

   `admincreated` char(1) NOT NULL default '0',

-  `password` varchar(40) NOT NULL default '0',

+  `password` varchar(255) NOT NULL default '0',

   PRIMARY KEY  (`uid`),

   KEY `penname` (`penname`),

   KEY `admincreated` (`admincreated`)

@@ -65,6 +65,7 @@ define ("_JAVASCRIPTOFF", "You must have javascript enabled for this form to wor

 define ("_LIKE", "like");

 define ("_LIKES_NUMBER", "Number of Likes");

 define ("_LOGIN", "Log In");

+define ("_LOGINAGAIN", "<br>However, if you have changed your password, you will have to <a href=\"login.php\">login again</a>.");

 define ("_PLEASELOGIN", "Please login to access this feature.");

 define ("_MEMBER", "Member");

 define ("_MEMBERS", "Members");

@@ -68,7 +68,7 @@ function random_string ($charset_string, $length)

 					if(!$pwdsetting) {

 						$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';

 						$pass = random_string($charset, 10);

-						$encryppass = md5($pass);

+						$encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);

 					}

 					else {

 						if($_POST['password'] != $_POST['password2']) {

@@ -79,7 +79,7 @@ function random_string ($charset_string, $length)

 							exit( );

 						}

 						$pass = $_POST['password2'];

-						$encryppass = md5($pass);

+						$encryppass = password_hash($pass, PASSWORD_BCRYPT, ['cost' => 12]);

 					}

 					dbquery("INSERT INTO ".substr(_AUTHORTABLE, 0, strpos(_AUTHORTABLE, "as author"))." (penname, realname, bio, email, date, password) VALUES ('".escapestring($penname)."', '".escapestring(strip_tags($_POST['realname']))."', '".strip_tags(escapestring($_POST['bio']), $allowed_tags)."', '$email'," . time() . ", '$encryppass')");

 					$useruid = dbinsertid();

@@ -153,7 +153,7 @@ function random_string ($charset_string, $length)

 		else{

 			 if(($_POST['password']) && ($_POST['password2'])) {

 				if($_POST['password'] == $_POST['password2']) {

-					$encryppassword = md5($_POST['password']);

+					$encryppassword = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);

 					dbquery("UPDATE "._AUTHORTABLE." SET password='$encryppassword' WHERE uid = '$uid'");

 				}

 				else $output .=  write_error(_PASSWORDTWICE);

@@ -183,7 +183,7 @@ function random_string ($charset_string, $length)

 			}

 /* End dynamic fields */

 			dbquery("UPDATE "._AUTHORTABLE." SET realname='".descript(strip_tags(escapestring($_POST['realname'])), $allowed_tags)."', email='$email', bio='".descript(strip_tags(escapestring($_POST['bio']), $allowed_tags))."', image='".($imageupload && !empty($_POST['image']) ? escapestring($_POST['image']) : "")."' WHERE uid = '$uid'");

-			$output .= write_message(_ACTIONSUCCESSFUL."  ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT));

+			$output .= write_message(_ACTIONSUCCESSFUL."  ".(isset($_GET['uid']) ? _BACK2ADMIN : _BACK2ACCT." "._LOGINAGAIN));

 		}

 	}

 	else {

@@ -52,7 +52,8 @@

 			header("Location: maintenance.php");

 			exit( );

 		}

-		$encryptedpassword = md5($_POST['password']);

+		$encryptedpasswordb = $passwd['password'];

+		$encryptedpasswordm = md5($_POST['password']);

 		if($passwd['level'] == -1) {

 			require_once("header.php");

 			//make a new TemplatePower object

@@ -65,14 +66,28 @@

 			dbclose( );

 			exit( );

 		}

-		if($passwd['password'] == $encryptedpassword) {

+		if(password_verify($_POST['password'], $encryptedpasswordb) == $encryptedpasswordb) {

 			if(isset($_POST['cookiecheck'])) {

 				setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");

-				setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpassword),  time()+60*60*24*30, "/");

+				setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordb),  time()+60*60*24*30, "/");

 			}

 			if(!isset($_SESSION)) session_start( );

 			$_SESSION[$sitekey."_useruid"] = $passwd['uid'];

-			$_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpassword);

+			$_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordb);

+			$logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");

+			while($code = dbassoc($logincode)) {

+				eval($code['code_text']);

+			}

+		}

+

+		else if($passwd['password'] == $encryptedpasswordm) {

+			if(isset($_POST['cookiecheck'])) {

+				setcookie($sitekey."_useruid",$passwd['uid'], time()+60*60*24*30, "/");

+				setcookie($sitekey."_salt", md5($passwd['email'] . $encryptedpasswordm),  time()+60*60*24*30, "/");

+			}

+			if(!isset($_SESSION)) session_start( );

+			$_SESSION[$sitekey."_useruid"] = $passwd['uid'];

+			$_SESSION[$sitekey."_salt"] = md5($passwd['email'] . $encryptedpasswordm);

 			$logincode = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_codeblocks WHERE code_type = 'login'");

 			while($code = dbassoc($logincode)) {

 				eval($code['code_text']);

@@ -54,7 +54,7 @@ if(isMEMBER) accessDenied( );

 				mt_srand((double)microtime() * 1000000);

 				$charset = '23456789' . 'abcdefghijkmnpqrstuvwxyz' . 'ABCDEFGHJKLMNPQRSTUVWXYZ';		

 				$pass = random_string($charset, 10);

-				$encryppass = md5($pass);

+				$encryppass = password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]);

 				$subject = _NEWPWDSUB;

 				$mailtext = sprintf(_NEWPWDMSG, $pass);