// The user is not authticated yet
$auth = false;
$updated = false;

// From your Login form
$user = $_POST['user'];
$pass = $_POST['pass'];

// Check If the username has update password
$udated = false; // not update

// I gues you always do this
$password = $updated ? md5($pass) : sha1($pass);

// Do the autentication
// Slect from Database
// Check the data
// Set auth
$auth = true;

// Then chage the password
if ($auth == true && !$updated) {
    $newpassword = sha1($pass);
    // Connect to DB
    // Update the Password
    // Set status to Updated in DB
    $udated = true;
}

// Better ApPRoch
if ($auth == true && !$updated) {
    $newpassword = password_hash($password,PASSWORD_BCRYPT);
    // Connect to DB
    // Update the Password
    // Set Status to Updated in DB
    $updated = true;
}

我使用password_hash有一个更好的方法,因为它使用BCRYPT这是一个更好的哈希算法. See more information on password_compat