why are you adding slashes to the password before converting it into md5? even if they have ' in the password the md5 would get rid of it when you use it in the query.