title: I am stuck with registration/login in php...passwords are not matching when login-using hash('sha256',$password)
body: <pre><code>&lt;?php
  //&lt;!--Start session--&gt;
  session_start();
  include('connection.php'); 
  
  //&lt;!--Check user inputs--&gt;
  //    &lt;!--Define error messages--&gt;
  $missingUsername = '&lt;p&gt;&lt;strong&gt;Please enter a username!&lt;/strong&gt;&lt;/p&gt;';
   $missingEmail = '&lt;p&gt;&lt;strong&gt;Please enter your email address!&lt;/strong&gt;&lt;/p&gt;';
  $invalidEmail = '&lt;p&gt;&lt;strong&gt;Please enter a valid email address!&lt;/strong&gt;&lt;/p&gt;';
  $missingPassword = '&lt;p&gt;&lt;strong&gt;Please enter a Password!&lt;/strong&gt;&lt;/p&gt;';
  $invalidPassword = '&lt;p&gt;&lt;strong&gt;Your password should be at least 6 characters long and inlcude one capital letter and one number!&lt;/strong&gt;&lt;/p&gt;';
  $differentPassword = '&lt;p&gt;&lt;strong&gt;Passwords don\'t match!&lt;/strong&gt;&lt;/p&gt;';
  $missingPassword2 = '&lt;p&gt;&lt;strong&gt;Please confirm your password&lt;/strong&gt;&lt;/p&gt;';
  //    &lt;!--Get username, email, password, password2--&gt;
  //Get username
  if(empty($_POST["username"])){
      $errors .= $missingUsername;
  }else{
      $username = filter_var($_POST["username"], FILTER_SANITIZE_STRING);   
  }
  //Get email
  if(empty($_POST["email"])){
      $errors .= $missingEmail;   
  }else{
      $email = filter_var($_POST["email"], FILTER_SANITIZE_EMAIL);
      if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
          $errors .= $invalidEmail;   
      }
  }
  //Get passwords
  if(empty($_POST["password"])){
      $errors .= $missingPassword; 
  }elseif(!(strlen($_POST["password"])&gt;6
           and preg_match('/[A-Z]/',$_POST["password"])
           and preg_match('/[0-9]/',$_POST["password"])
          )
         ){
      $errors .= $invalidPassword; 
  }else{
      $password = filter_var($_POST["password"], FILTER_SANITIZE_STRING); 
      if(empty($_POST["password2"])){
          $errors .= $missingPassword2;
      }else{
          $password2 = filter_var($_POST["password2"], FILTER_SANITIZE_STRING);
          if($password !== $password2){
              $errors .= $differentPassword;
          }
      }
  }
  //If there are any errors print error
  if($errors){
      $resultMessage = '&lt;div class="alert alert-danger"&gt;' . $errors .'&lt;/div&gt;';
      echo $resultMessage;
      exit;
  }
  
  //no errors
  
  //Prepare variables for the queries
  $username = mysqli_real_escape_string($link, $username);
  $email = mysqli_real_escape_string($link, $email);
  $password = mysqli_real_escape_string($link, $password);
  //$password = md5($password);
  $password = hash('sha256', $password);
  //$password= password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
  //128 bits -&gt; 32 characters
  //256 bits -&gt; 64 characters
  //If username exists in the users table print error
  $sql = "SELECT * FROM users WHERE username = '$username'";
  $result = mysqli_query($link, $sql);
  if(!$result){
      echo '&lt;div class="alert alert-danger"&gt;Error running the query!&lt;/div&gt;';
  //    echo '&lt;div class="alert alert-danger"&gt;' . mysqli_error($link) . '&lt;/div&gt;';
      exit;
  }
  $results = mysqli_num_rows($result);
  if($results){
      echo '&lt;div class="alert alert-danger"&gt;That username is already registered. Do you want to log in?&lt;/div&gt;';  exit;
  }
  //If email exists in the users table print error
  $sql = "SELECT * FROM users WHERE email = '$email'";
  $result = mysqli_query($link, $sql);
  if(!$result){
      echo '&lt;div class="alert alert-danger"&gt;Error running the query!&lt;/div&gt;'; exit;
  }
  $results = mysqli_num_rows($result);
  if($results){
      echo '&lt;div class="alert alert-danger"&gt;That email is already registered. Do you want to log in?&lt;/div&gt;';  exit;
  }
  //Create a unique  activation code
  $activationKey = bin2hex(openssl_random_pseudo_bytes(16));
      //byte: unit of data = 8 bits
      //bit: 0 or 1
      //16 bytes = 16*8 = 128 bits
      //(2*2*2*2)*2*2*2*2*...*2
      //16*16*...*16
      //32 characters
  
  //Insert user details and activation code in the users table
  
  $sql = "INSERT INTO users (`username`, `email`, `password`, `activation`) VALUES ('$username', '$email', '$password', '$activationKey')";
  $result = mysqli_query($link, $sql);
  if(!$result){
      echo '&lt;div class="alert alert-danger"&gt;There was an error inserting the users details in the database!&lt;/div&gt;'; 
      exit;
  }
  
  //Send the user an email with a link to activate.php with their email and activation code
  $message = "Please click on this link to activate your account:\n\n";
  $message .= "http://maths.offyoucode.co.uk/activate.php?email=" . urlencode($email) . "&amp;key=$activationKey";
  if(mail($email, 'Confirm your Registration', $message, 'From:'.'rajeshsunil107@gmail.com')){
         echo "&lt;div class='alert alert-success'&gt;Thank for your registring! A confirmation email has been sent to $email. Please click on the activation link to activate your account.&lt;/div&gt;";
  }
  
          ?&gt;
  </code></pre>
  
  <p>**This is my signup code ..signup code is hashing and it's fine and storing into database ...can you please check the code for...The below code is login code **</p>
  
  <pre><code>&lt;?php
  //Start session
  session_start();
  //Connect to the database
  include("connection.php");
  //Check user inputs
      //Define error messages
  $missingEmail = '&lt;p&gt;&lt;stong&gt;Please enter your email address!&lt;/strong&gt;&lt;/p&gt;';
  $missingPassword = '&lt;p&gt;&lt;stong&gt;Please enter your password!&lt;/strong&gt;&lt;/p&gt;'; 
      //Get email and password
      //Store errors in errors variable
  if(empty($_POST["loginemail"])){
      $errors .= $missingEmail;   
  }else{
      $email = filter_var($_POST["loginemail"], FILTER_SANITIZE_EMAIL);
  }
  if(empty($_POST["loginpassword"])){
      $errors .= $missingPassword;   
  }else{
      $password = filter_var($_POST["loginpassword"], FILTER_SANITIZE_STRING);
  }
      //If there are any errors
  if($errors){
      //print error message
      $resultMessage = '&lt;div class="alert alert-danger"&gt;' . $errors .'&lt;/div&gt;';
      echo $resultMessage;   
  }else{
      //else: No errors
      //Prepare variables for the query
      $email = mysqli_real_escape_string($link, $email);
  $password = mysqli_real_escape_string($link, $password);
  //$password = hash('sha256', $password);
  $password = hash('sha256', $password);
  //$password=password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
          //Run query: Check combinaton of email &amp; password exists
  $sql = "SELECT * FROM users WHERE email='$email' AND password='$password' AND activation='activated'";
  $result = mysqli_query($link, $sql);
  if(!$result){
      echo '&lt;div class="alert alert-danger"&gt;Error running the query!&lt;/div&gt;';
      exit;
  }
          //If email &amp; password don't match print error
  $count = mysqli_num_rows($result);
  if($count !== 1){
      echo '&lt;div class="alert alert-danger"&gt;Wrong Username or Password&lt;/div&gt;';
  }
  else {
      //log the user in: Set session variables
      $row = mysqli_fetch_array($result, MYSQLI_ASSOC);
      $_SESSION['user_id']=$row['user_id'];
      $_SESSION['username']=$row['username'];
      $_SESSION['email']=$row['email'];
  
      if(empty($_POST['rememberme'])){
          //If remember me is not checked
          echo "success";
      }else{
          //Create two variables $authentificator1 and $authentificator2
          $authentificator1 = bin2hex(openssl_random_pseudo_bytes(10));
          //2*2*...*2
          $authentificator2 = openssl_random_pseudo_bytes(20);
          //Store them in a cookie
          function f1($a, $b){
              $c = $a . "," . bin2hex($b);
              return $c;
          }
          $cookieValue = f1($authentificator1, $authentificator2);
          setcookie(
              "rememberme",
              $cookieValue,
              time() + 1296000
          );
  
          //Run query to store them in rememberme table
          function f2($a){
              $b = hash('sha256', $a); 
              return $b;
          }
          $f2authentificator2 = f2($authentificator2);
          $user_id = $_SESSION['user_id'];
          $expiration = date('Y-m-d H:i:s', time() + 1296000);
  
          $sql = "INSERT INTO rememberme
          (`authentificator1`, `f2authentificator2`, `user_id`, `expires`)
          VALUES
          ('$authentificator1', '$f2authentificator2', '$user_id', '$expiration')";
          $result = mysqli_query($link, $sql);
          if(!$result){
              echo  '&lt;div class="alert alert-danger"&gt;There was an error storing data to remember you next time.&lt;/div&gt;';  
          }else{
              echo "success";   
          }
      }
  }
      }
  
   ?&gt;
  </code></pre>
  
  <p>Th above code is my login code ...where it showing the wrong username and password when i login with same username and password as with signup username and password</p>