[korny]

OK... im still getting two different hashes. What you are saying is i should apply the code you provided to the hash in the cookie?

OK... so I tried this (minus some obvious stuff, but you should get the point):

$bbuserid = $HTTP_COOKIE_VARS["bbuserid"];
$bbpassword = $HTTP_COOKIE_VARS["bbpassword"];

$query = "SELECT password, salt FROM user WHERE userid = '$bbuserid'";
$result = mysql_query($query, $connection);

$salt = mysql_result($result, 0, "salt");
$password = mysql_result($result, 0, "password");

$bbpassword = md5(md5($bbpassword).$salt);

But this still doesn't work... $password (from the db) and $bbpassword (from the cookie) still do not match. I even tried switching it around and applying what you have told me to the hash in the DB, but still no luck.

It seems VB has made their product more secure, must much less customizable since no one at VB will answer this question. It may just be time to switch to different software.