title: Does md5 stop SQL Injection
body: <p>Ok, </p>
  
  <p>So, i'm a little unsure on this. </p>
  
  <p>I have a url parameter <strong>username</strong>.</p>
  
  <p>and I have this statement</p>
  
  <pre><code>SELECT * FROM users WHERE user_hash = md5($_GET['username'])
  </code></pre>
  
  <p>Is this secure?</p>
  
  <p>Upon account creation an md5 hashed version of the username and the password are stored.</p>
  
  <p>I'm confused as this seems so simple, if md5 stops sql injection why isn't username and password always saved in hash form?</p>