title: PHP hashed & salted password
body: <p>So I'm creating a simple PHP register/log in form. I have created a hash &amp; salt for the password, but I can't seem to log in using the correct password. As in it's hashing it incorrectly? Bare in mind I'm not a pro.</p>
  
  <p>Registration code, works fine, hashes the pw &amp; stores the salt.</p>
  
  <pre><code>if ($errors === 0) {
              $salt = mcrypt_create_iv(32); 
              $signpassword = DatabaseHelpers::hash($signpassword, $salt);
              query("INSERT INTO user_info(Username, Email, Password, Salt) VALUES(:signusername, :email, :signpassword, :salt)",
              array('signusername' =&gt; $signusername, 'email' =&gt; $email, 'signpassword' =&gt; $signpassword, 'salt' =&gt; $salt),
              $conn);
              $successstatus = 'You have successfully registered';
  }  
  };
  </code></pre>
  
  <p>The log in code</p>
  
  <pre><code>$username = $_POST['username'];
  $password = $_POST['password'];
  
  function verify($password, $salt) {
   hash('sha256', $password . $salt);
      }//function for verifying the password, doesn't seem to be working
  
  if (empty($username) || empty($password)) {
      $logstatus = 'Please input your username and password';
      //update login attempts
  } else {
  
      $salts = $conn-&gt;prepare('SELECT salt FROM user_info where username=?');
      $salts-&gt;bindParam(1, $username);
      $salts-&gt;execute();
      $salts = $salts-&gt;fetch(PDO::FETCH_ASSOC);
      foreach ($salts as $slt) {
          $slt = $salt;
      }//gets the salt
  
      $hashedpassword = verify($password, $salt);//
      $stmt = $conn-&gt;prepare('SELECT * FROM user_info where username=? and password=?');
      $stmt-&gt;bindParam(1, $username);
      $stmt-&gt;bindParam(2, $hashedpassword);
      $stmt-&gt;execute();
  
      function start($username, $sessionName){
          header(  'Location: logging.php') ;
          session_start();
          $_SESSION['username'] = $username;  
      };
  
  
      if($stmt-&gt;rowCount() == 1) {
         start($username, $sessionName);
      } else {
          $logstatus = 'Username or password incorrect.';
      }
  };};};
  </code></pre>
  
  <p>It always does the else statement, when I input the correct password. If I comment out the hashing and put in the hashed pw from the database, it logs me in? I know it's probably something really dumb but I can't see it. Anyone help me out? It's driving me crazy -_-</p>
  
  <p>------------------Okay guys, remember, I'm not an expert. </p>
  
  <p>I tested it again with the return and found out the two passwords result to two completely different passwords.</p>
  
  <p>75642f23ef3c7b35d0a5e223a9c3187d102e77dcc121b5d08c7bbcb44de73e2c 
  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b</p>
  
  <p>I don't know. Spent too much time on this stupid salting stuff, was just trying to learn -_-, guess I'll go with the built in hashing functions and never learn from my mistake, sigh...</p>
  
  <p>Yeah, not everyone has PHP 5.5 so I can't use those built in functions.</p>