Bug in Migrating md5 to hash in Laravel - php

Question

The algorithm works, but once the password has been converted to hash and saved into the database, it doesn't redirect to the homepage. Instead, it redirects to the login page saying that the login credentials is incorrect. But if I tried logging in, it is ok. What am I doing wrong?
AuthenticatesUsers.php
protected function attemptLogin(Request $request)
{
$check = $this->guard()->attempt(
$this->credentials($request), $request->has('remember')
);
if ($check === false)
{
$user = User::where('username','=',$request->input('username'))->first();
if(isset($user)) {
if($user->password == md5($request->input('password'))) { // If their password is still MD5
$hashed_password = Hash::make($request['password']); // Convert to new format
$user->password = $hashed_password;
$user->save();
return $this->guard()->attempt(
array(
'username'=>$request->input('username'),
'password'=>$hashed_password
), $request->has('remember')
);
} else {
// Redirect to the login page.
return false;
}
}
}
return $check;
}

Answer 1

attempt doesn't take the hashed password, it takes the password you would get from the user (the plain text password). The user doesn't know the hashed version of their password and attempt does a hash check which requires the plain text version.
You also don't need to call attempt that second time if you have already validated the user and their credentials and have a User instance that represents them. Just use login to log them in at that point. You don't have to go through attempt which is just going to requery the database to get the user, then check the hash that you know is correct since you just set it.
To a degree part of the code you have is just recreating what attempt does internally.
Also you don't need to query the database yourself for the User. That first call to attempt will have held onto the 'user' it found from when it queried the database. You can retrieve it from the guard so you don't have to query the database again, $this->guard()->getLastAttempted().
Making these changes will remove the 'bad credentials' issue coming from the second attempt call, since it won't be called any more. This will also cut your queries down from 3 selects and 1 update to 1 select and 1 update. (roughly)