[MarkPW]

Since you have a connection to your database, you can use mysql_real_escape_string() (which you should use anyway). This should solve your problem:

PHP Code:

$salt = mysql_real_escape_string(fetch_user_salt());
$hash = mysql_real_escape_string(hash_password($password, $salt));

$update = mysql_query("UPDATE users SET `password`='$hash', `salt`='$salt' WHERE `id`='$id'") or die(mysql_error());