This is absolutely unacceptable for anything but verifying legacy hashes. Plain and simple. Using `md5($password . $salt)` for new hashes is **bad**...