How is it that databases of password hashes can be stolen in te first place? It seems that you need a pretty severe firewall and server breech for that to occur.
Usually because the password database is able to be compromised by some code injection bug (e.g. SQLi). In order to prevent this you should be using a library the makes it impossible to mix code and input data like that.
