You talk about how modern GPUs can calculate md5 hashes very fast. This is why you should use something else than md5 or sha1 - they are both designed to be fast.

If you can, you could consider using blowfish instead, which is a much slower algorithm. It isn't slow enough to take too long when you just want to hash a user's new password or anything like that though, so it's usable in that regard.

You can use Blowfish in PHP via PEAR Crypt_Blowfish or using the builtin crypt() function (altho not entirely sure if it has support for blowfish pre 5.3)