I can't seem to get this to do anything but return false. My best guess is that the prepared statement isn't executing, but I have no idea why.

  private function check_credentials($plain_username, $md5_password)
    {
    global $dbcon;

    $ac = new ac();
    $ac->dbconnect();
    $userid = $dbcon->prepare('SELECT id FROM users WHERE username = :username AND password = :password LIMIT 1');
    $userid->bindParam(':username', $plain_username);
    $userid->bindParam(':password', $md5_password);
    $userid->execute();

    $id = $userid->fetch();
    Return $id;
    }

*EDIT:*I've even tried hard coding the username and password into the function itself to try and isolate the problem like this:

private function check_credentials($plain_username, $md5_password)
    {
    global $dbcon;

    $plain_username = "jim";
    $md5_username = "waffles";  

    $ac = new ac();
    $ac->dbconnect();
    $userid = $dbcon->prepare('SELECT id FROM users WHERE username = :username AND password = :password LIMIT 1');
    $userid->bindParam(':username', $plain_username);
    $userid->bindParam(':password', $md5_password);
    $userid->execute();
    print_r($dbcon->errorInfo());

    $id = $userid->fetch();
    Return $id;
    }

Still nothing :-/