title: PHP Invalid password even if valid
body: <p>I am trying to make a login system using php, mysql but even if I enter correct username and password combination, the site tells me that they are invalid.</p>
  
  <p>What is the problem?</p>
  
  <p>My code:</p>
  
  <pre><code>     &lt;?php
      session_start();
        $error_msg = "";
  
        if (!isset($_SESSION['user_id'])) {
          if (isset($_POST['submit'])) {
            require_once('config.php');
            $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
  
            $user_username = mysqli_real_escape_string($dbc, trim($_POST['username']));
            $user_password = mysqli_real_escape_string($dbc, trim($_POST['password']));
  
            if (!empty($user_username) &amp;&amp; !empty($user_password)) {
              $query = "SELECT user_id, username FROM users WHERE username = '$user_username' AND password = SHA('$user_password')";
              $data = mysqli_query($dbc, $query);
  
              if (mysqli_num_rows($data) == 1) {
                $row = mysqli_fetch_array($data);
                $_SESSION['user_id'] = $row['user_id'];
                $_SESSION['username'] = $row['username'];
  
                setcookie('user_id', $row['user_id'], time() + (60 * 60 * 24 * 30));    // expires in 30 days
                setcookie('username', $row['username'], time() + (60 * 60 * 24 * 30));  // expires in 30 days
                $home_url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . '/loggedin.php';
                header('Location: ' . $home_url);     
              }
              else {
                $error_msg = 'Invalid username and/or password.';  
              }
            }
            else {
              $error_msg = 'No empty fields allowed!';
            }
          }
        }
  
          echo '&lt;a href="register.php"&gt;Click to register&lt;/a&gt;';   
      ?&gt;
  &lt;HTML&gt;
  &lt;BODY&gt;
        &lt;form method="post" action="&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;"&gt;
        &lt;?php
          if (empty($_SESSION['user_id'])) {
          echo '&lt;p&gt;' . $error_msg . '&lt;/p&gt;';
          ?&gt;
          &lt;fieldset&gt;
            &lt;legend&gt;Login&lt;/legend&gt;
            &lt;label for="username"&gt;&lt;font color="black"&gt;Username:&lt;/font&gt;&lt;/label&gt;
            &lt;input type="text" name="username" value="&lt;?php if (!empty($user_username)) echo $user_username; ?&gt;" /&gt;&lt;br /&gt;
            &lt;label for="password"&gt;&lt;font color="black"&gt;Password:&lt;/font&gt;&lt;/label&gt;
            &lt;input type="password" name="password" /&gt;&lt;br /&gt;
          &lt;/fieldset&gt;
          &lt;input type="submit" value="Login" name="submit" /&gt;
        &lt;/form&gt;
  
  
      &lt;?php
        }
        else {
          // Successful
          echo('');
        }
      ?&gt;  
      &lt;/BODY&gt;
      &lt;/HTML&gt;
  </code></pre>
  
  <p>You may wonder if I have the correct data in config.php.
  Yes, I have the correct connection username, host, password, and db name, because I use the same file to the registration and it works perfectly.</p>
  
  <p>Thanks,
  Henrik</p>