You dont prepare your SELECT and UPDATE statements, and dont use md5; http://php.net/manual/en/faq.passwords.php#faq.passwords.fasthash
You should atleast add "salt" to your passwords.passwords; http://php.net/manual/en/faq.passwords.php#faq.passwords.salt