There are numerous MD5 decoding (dictionary) sites online that I've found can get through even my random 18character password quite fast... MD5 is only (even partially) secure if one where to dual salt it and md5 it twice (as CC suggested would be in .t7 during writeup).
As for checking, compare user input string to string in db; easy enough.
