Other than the slight flaw that you'll take a long time to even have a 50% chance of returning a match for a given MD5 hash even if you got a million hits an hour constantly, you should be aware that when searching for a hash that's not already stored it gives a PHP error message as opposed to a friendly 'not found' method, due to the very badly coded (and weakly vulnerable in terms of directory traversal) flat-file file storage system used by the app.