General rules to avoid getting your website hacked

If it's enabled, disable magic_quotes, it's pointless, use mysql_real_escape_string instead.
Never trust user data.
Never trust data that is passed from a web page (i.e. hidden form fields)
If you do use MD5 to encrypt passwords, do it something like this:

$password = "1337d0nk3y";
$salt = "StRInGoFNumBeRSAnDlETTeRs!3784";
$encrypted_pass = encryptPass($password);

function encryptPass($password){
return md5( md5( $salt . $password ) . $salt );
}

There are ways of reversing a straight MD5 (via lookup tables).