People being able to use SQL injectors on my website and pulling passwords [HELP]

How are you getting the SQL injection? (Or, I should say, what language does your server run on?)
If it's PHP (and a version lower than 5), you should probably look into using prepared statements (which effectively makes SQL injection impossible) or mysqli_real_escape_string (which makes SQL injection harder).

MD5 is not safe. It's an old hashing method, and you really should look into using bcrypt or at the very least SHA256. Let me know if you need any more information and I'll be happy to help.