/me actually bothers to look at the php docs

It looks like md5() outputs a hex string, so manually converting it to hex isn't needed (I thought md5() output the raw binary). (for reference, I guessed at the name hex(), but it turns out the function is actually called bin2hex())

Truncating the hash to 8 chars shouldn't be a problem, just make sure you do the same when you compare the hash later.