[MHard]

Which in itself would be a bad security practice because that would mean that the passwords aren't individually salted.

[sgjohnson]

And they would be hashed using MD5!

But on a serious note, it's possible to individually salt passwords, and still match username & password in one query.