um, haven't tried this, but given the code presented and the pass2/3 correction:
Shouldn't strtolower be before md5?
strtolower(md5('pAssword')) is totally different than md5(strtolower('pAssword'))
Anyway, I'd give it a try, but I really don't want to lock my accout out for 30 mins
