in reply to annoying HASH (0xsomething)

Beware!

param('pass') == param ('pass_again')

If your passwords are always numeric, that will work -- but your passwords probably contain characters. Use a string comparison to avoid numeric coercion:

param('pass') eq param ('pass_again')