Importing encrypted passwords

[dave conz]

I'm so close but can't quite get it. I've created a user with the crypt'd password "test" (aaqPiZY5xR5l.). If I enter the following code it works fine:
AND $bbuserinfo['password'] != crypt("test","aa")

But if I use the password variable it no longer works:
AND $bbuserinfo['password'] != crypt($password,"aa")

I've even defined a test variable which works:
$oldpassword = "test";
.....
AND $bbuserinfo['password'] != crypt($oldpassword,"aa")

This seems to indicate that the variable $password isn't actually "test" at this point. Any ideas what's going on, or how I can see the actual value of $password?

[Link14716]

There is a JavaScript on all the login forms that blanks the password variable and md5's it, then sends it as $md5password. Have you removed that JS?

[dave conz]

Aha. I didn't know about that. I went to clientscript/vbulletin_md5.js and commented out the guts of the md5hash function and it all works now! Am I right in thinking this function is a non-critical extra security measure and I won't be leaving a huge security hole without it?

Once the new board is up and running I'll get everyone to update their passwords over the first couple of months, then remove this hack.