PHP: update the MD5 hash application for writing. It is safe?

Question

Sorry, this is being asked somewhere else, but I did not find it. The problem is upgrading my legacy PHP application to a more secure password hash. I currently have MD5, but I want to use a script with the new password_hash () function. I thought about the path, but I do not know if it is really safe. This is simplified code:

if (password_verify($input_password, $user->password hash) === false) {
    if (md5($input_password) === $user->password_hash) {
        user->password_hash = password_hash(
            $input_password,
            $currentHashAlgoritm,
            $currentHashOptions
        );
        $user->save;
    } else {
        throw new Exception('Invalid Password');
    }
}
//Save login status to session

Basically, what I'm trying to do is rephrase the password if the initial check is bad, but the MD5 check is good. BUT what happens if someone puts a bad password and:

md5($bad_password) == $user->password_hash (hashed by bycript)

This is a very subtle way to log in with the wrong password.

Is this the only way or the best way? Thanks to everyone. And sorry for the bad english.

Answer 1

, , PHP password_hash , , , , md5, .

, md5($bad_password) password_hash ( ; bcrypt from password_hash "$ 2y $", "$", "y" - md5. "$ 2y $" , - bcrypt .)