diff --git a/classes/auth/base.php b/classes/auth/base.php
index 9b2f630c0..883c0df30 100644
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -23,13 +23,14 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
 
 				if (!$password) $password = make_password();
 
-				$salt = UserHelper::get_salt();
-				$pwd_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]);
+				$user = ORM::for_table('ttrss_users')->create();
 
-				$sth = $this->pdo->prepare("INSERT INTO ttrss_users
-						(login,access_level,last_login,created,pwd_hash,salt)
-						VALUES (LOWER(?), 0, null, NOW(), ?,?)");
-				$sth->execute([$login, $pwd_hash, $salt]);
+				$user->salt = UserHelper::get_salt();
+				$user->login = mb_strtolower($login);
+				$user->pwd_hash = UserHelper::hash_password($password, $user->salt);
+				$user->access_level = 0;
+				$user->created = 'NOW()';
+				$user->save();
 
 				return UserHelper::find_user_by_login($login);
 
diff --git a/classes/feeds.php b/classes/feeds.php
index 55a71aebb..bf165f93a 100755
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -474,8 +474,9 @@ class Feeds extends Handler_Protected {
 
 		/* bump login timestamp if needed */
 		if (time() - $_SESSION["last_login_update"] > 3600) {
-			$sth = $this->pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
-			$sth->execute([$_SESSION['uid']]);
+			$user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
+			$user->last_login = 'NOW()';
+			$user->save();
 
 			$_SESSION["last_login_update"] = time();
 		}
diff --git a/classes/pref/users.php b/classes/pref/users.php
index ff9bf1712..071f20a73 100644
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -113,7 +113,7 @@ class Pref_Users extends Handler_Administrative {
 				if ($id == 1) $login = "admin";
 				if (!$login) return;
 
-				$user->login = $login;
+				$user->login = mb_strtolower($login);
 				$user->access_level = (int) clean($_REQUEST["access_level"]);
 				$user->email = clean($_REQUEST["email"]);
 
@@ -144,30 +144,25 @@ class Pref_Users extends Handler_Administrative {
 
 		function add() {
 			$login = clean($_REQUEST["login"]);
-			$tmp_user_pwd = make_password();
-			$salt = UserHelper::get_salt();
 
 			if (!$login) return; // no blank usernames
 
 			if (!UserHelper::find_user_by_login($login)) {
 
+				$new_password = make_password();
+
 				$user = ORM::for_table('ttrss_users')->create();
 
-				$tmp_user_pwd = make_password();
-				$salt = UserHelper::get_salt();
-
-				$user->login = $login;
-				$user->pwd_hash = UserHelper::hash_password($tmp_user_pwd, $salt);
+				$user->salt = UserHelper::get_salt();
+				$user->login = mb_strtolower($login);
+				$user->pwd_hash = UserHelper::hash_password($new_password, $user->salt);
 				$user->access_level = 0;
-				$user->salt = $salt;
 				$user->created = 'NOW()';
 				$user->save();
 
 				if ($new_uid = UserHelper::find_user_by_login($login)) {
-
 					print T_sprintf("Added user %s with password %s",
-						$login, $tmp_user_pwd);
-
+						$login, $new_password);
 				} else {
 					print T_sprintf("Could not create user %s", $login);
 				}
diff --git a/classes/userhelper.php b/classes/userhelper.php
index 84dc71383..1d14b51b0 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -131,8 +131,9 @@ class UserHelper {
 
 			} else {
 				/* bump login timestamp */
-				$sth = $pdo->prepare("UPDATE ttrss_users SET last_login = NOW() WHERE id = ?");
-				$sth->execute([$_SESSION['uid']]);
+				$user = ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
+				$user->last_login = 'NOW()';
+				$user->save();
 
 				$_SESSION["last_login_update"] = time();
 			}
@@ -202,38 +203,31 @@ class UserHelper {
 
 	static function reset_password($uid, $format_output = false, $new_password = "") {
 
-		$pdo = Db::pdo();
+		$user = ORM::for_table('ttrss_users')->find_one($uid);
+		$message = "";
 
-		$sth = $pdo->prepare("SELECT login FROM ttrss_users WHERE id = ?");
-		$sth->execute([$uid]);
+		if ($user) {
 
-		if ($row = $sth->fetch()) {
-
-			$login = $row["login"];
+			$login = $user->login;
 
 			$new_salt = self::get_salt();
 			$tmp_user_pwd = $new_password ? $new_password : make_password();
 
 			$pwd_hash = self::hash_password($tmp_user_pwd, $new_salt, self::HASH_ALGOS[0]);
 
-			$user = ORM::for_table('ttrss_users')->find_one($uid);
-
-			if ($user) {
-				$user->pwd_hash = $pwd_hash;
-				$user->salt = $new_salt;
-				$user->save();
-
-				$message = T_sprintf("Changed password of user %s to %s", "<strong>$login</strong>", "<strong>$tmp_user_pwd</strong>");
-			} else {
-				$message = T_sprintf("User not found: %s", $login);
-			}
-
-			if ($format_output)
-				print_notice($message);
-			else
-				print $message;
+			$user->pwd_hash = $pwd_hash;
+			$user->salt = $new_salt;
+			$user->save();
 
+			$message = T_sprintf("Changed password of user %s to %s", "<strong>$login</strong>", "<strong>$tmp_user_pwd</strong>");
+		} else {
+			$message = __("User not found");
 		}
+
+		if ($format_output)
+			print_notice($message);
+		else
+			print $message;
 	}
 
 	static function check_otp(int $owner_uid, int $otp_check) : bool {
diff --git a/include/sessions.php b/include/sessions.php
index 04c24cf72..0fa8428ad 100644
--- a/include/sessions.php
+++ b/include/sessions.php
@@ -36,27 +36,21 @@
 				return false;
 			}
 
-			$sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?");
-			$sth->execute([$_SESSION['uid']]);
+			$user = \ORM::for_table('ttrss_users')->find_one($_SESSION["uid"]);
 
-			// user not found
-			if ($row = $sth->fetch()) {
-					 $pwd_hash = $row["pwd_hash"];
+			if ($user) {
+				if ($user->pwd_hash != $_SESSION["pwd_hash"]) {
 
-					 if ($pwd_hash != $_SESSION["pwd_hash"]) {
+					$_SESSION["login_error_msg"] =
+						__("Session failed to validate (password changed)");
 
-						  $_SESSION["login_error_msg"] =
-								__("Session failed to validate (password changed)");
-
-						  return false;
-					 }
+					return false;
+				}
 			} else {
+				$_SESSION["login_error_msg"] =
+					__("Session failed to validate (user not found)");
 
-					 $_SESSION["login_error_msg"] =
-						  __("Session failed to validate (user not found)");
-
-					 return false;
-
+				return false;
 			}
 		}
 
diff --git a/plugins/auth_internal/init.php b/plugins/auth_internal/init.php
index b0596eed6..70f071057 100644
--- a/plugins/auth_internal/init.php
+++ b/plugins/auth_internal/init.php
@@ -146,19 +146,13 @@ class Auth_Internal extends Auth_Base {
 
 	function check_password(int $owner_uid, string $password, string $service = '') {
 
-		if (get_schema_version() > 87) {
-			$sth = $this->pdo->prepare("SELECT login,pwd_hash,salt FROM ttrss_users WHERE id = ?");
-		} else {
-			$sth = $this->pdo->prepare("SELECT login,pwd_hash FROM ttrss_users WHERE id = ?");
-		}
+		$user = ORM::for_table('ttrss_users')->find_one($owner_uid);
 
-		$sth->execute([$owner_uid]);
+		if ($user) {
 
-		if ($row = $sth->fetch()) {
-
-			$salt = $row['salt'] ?? "";
-			$login = $row['login'];
-			$pwd_hash = $row['pwd_hash'];
+			$salt = $user['salt'] ?? "";
+			$login = $user['login'];
+			$pwd_hash = $user['pwd_hash'];
 
 			list ($pwd_algo, $raw_hash) = explode(":", $pwd_hash, 2);
 
@@ -194,33 +188,31 @@ class Auth_Internal extends Auth_Base {
 			$new_salt = UserHelper::get_salt();
 			$new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]);
 
-			$sth = $this->pdo->prepare("UPDATE ttrss_users SET
-				pwd_hash = ?, salt = ?, otp_enabled = false
-					WHERE id = ?");
-			$sth->execute([$new_password_hash, $new_salt, $owner_uid]);
+			$user = ORM::for_table('ttrss_users')->find_one($owner_uid);
+
+			$user->salt = $new_salt;
+			$user->pwd_hash = $new_password_hash;
+			$user->save();
 
 			if ($_SESSION["uid"] ?? 0 == $owner_uid)
 				$_SESSION["pwd_hash"] = $new_password_hash;
 
-			$sth = $this->pdo->prepare("SELECT email, login FROM ttrss_users WHERE id = ?");
-			$sth->execute([$owner_uid]);
-
-			if ($row = $sth->fetch()) {
+			if ($user->email) {
 				$mailer = new Mailer();
 
 				$tpl = new Templator();
 
 				$tpl->readTemplateFromFile("password_change_template.txt");
 
-				$tpl->setVariable('LOGIN', $row["login"]);
+				$tpl->setVariable('LOGIN', $user->login);
 				$tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH));
 
 				$tpl->addBlock('message');
 
 				$tpl->generateOutputToString($message);
 
-				$mailer->mail(["to_name" => $row["login"],
-					"to_address" => $row["email"],
+				$mailer->mail(["to_name" => $user->login,
+					"to_address" => $user->email,
 					"subject" => "[tt-rss] Password change notification",
 					"message" => $message]);
 
@@ -244,21 +236,22 @@ class Auth_Internal extends Auth_Base {
 			$test_hash = UserHelper::hash_password($password, $salt, $pwd_algo);
 
 			if (hash_equals("$pwd_algo:$raw_hash", $test_hash)) {
-				$usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET last_used = NOW() WHERE id = ?");
-				$usth->execute([$row['id']]);
+				$pass = ORM::for_table('ttrss_app_passwords')->find_one($row["id"]);
+				$pass->last_used = 'NOW()';
 
 				if ($pwd_algo != UserHelper::HASH_ALGOS[0]) {
 					// upgrade password to current algo
 					Logger::log(E_USER_NOTICE, "Upgrading app password of user $login to " . UserHelper::HASH_ALGOS[0]);
 
-					$new_hash = UserHelper::hash_password($password, $salt, UserHelper::HASH_ALGOS[0]);
+					$new_hash = UserHelper::hash_password($password, $salt);
 
 					if ($new_hash) {
-						$usth = $this->pdo->prepare("UPDATE ttrss_app_passwords SET pwd_hash = ? WHERE id = ?");
-						$usth->execute(["$new_hash:$salt", $row['id']]);
+						$pass->pwd_hash = "$new_hash:$salt";
 					}
 				}
 
+				$pass->save();
+
 				return $row['uid'];
 			}
 		}