How so?
If they don't have the database info or access to the code, this can prove quite tricky to ever work out, IF you go about it the right way.
Adding some randomness into the storage function, such as:
$randomNumber = mt_rand(1000,1000000);
sha1($_POST['password'] . $randomNumber . substr($username, 0, 5));
Would be quite pressed to break that in any rainbow table or decryption table.
Plain MD5 is quite easily breakable since people will happily encrypt their passwords using an online tool such as MD5 Encryption and not accepting the fact that you have just gave your password the ability to be de-crypted using the same database at MD5 Decryption
Password circumvention is dependent, for the most part, on your encryption, imo.