In addition to that, what about a dictionary attack that takes a word, doe $md5() on it, and then a match--rather than to try to decrypt the hash?