title: Login Password Keeps Getting Error PHP, PDO, Salt
body: <pre><code>&lt;?php
  require_once "pdo.php";
  session_start();
  
  // Redirect to index.php if use clicks cancel button
  if ( isset($_POST['cancel'] ) ) {
      header("Location: index.php");
      return;
  }
  
  // salt and hash
  $salt = 'XyZzy12*_';
  
  // Check to see if we have some POST data, if we do process it
  if ( isset($_POST['email']) &amp;&amp; isset($_POST['pass']) ) {
  
      // Check for email and password
      if ( strlen($_POST['email']) &lt; 1 || strlen($_POST['pass']) &lt; 1 ) {
          //$failure = "Email and password are required";
          $_SESSION['error'] = "Email and password are required";
          header("Location: login.php");
          return;
  
      // Check for at-sign in email
      } elseif (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
          $_SESSION['error'] = "Email must have an at-sign (@)";
          header("Location: login.php");
          return;
  
      } else {
  
          //All looks good, so redirect to index.php
          $check = hash('md5', $salt.$_POST['pass']);
          if ( $check == true) {
              $_SESSION['name'] = $_POST['email'];
              error_log("Login success ".$_POST['email']);
              header("Location: index.php");
              return;
          } else {
              //Else redirect to the login page
              $_SESSION['error'] = "Incorrect Password";
              error_log("Login fail ".$_POST['email']." $check");
              header("Location: login.php");
              return;
  
          }
      }
  }
  
  ?&gt;
  
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;?php require_once "bootstrap.php"; ?&gt;
      &lt;title&gt;Login&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;div class="container"&gt;
  
          &lt;br /&gt;&lt;br /&gt;
  
          &lt;?php
  
          // Message View of Errors
          if ( isset($_SESSION['error']) ) {
              echo('&lt;p style="color: red;"&gt;'.htmlentities($_SESSION['error'])."&lt;/p&gt;\n");
              unset($_SESSION['error']);
          }
  
          ?&gt;
  
          &lt;h1&gt;Please Log In&lt;/h1&gt;
  
          &lt;form method="POST"&gt;
              &lt;label for="name"&gt;Email&lt;/label&gt;
              &lt;input type="text" name="email" id="name"&gt;&lt;br/&gt;
              &lt;label for="id_1723"&gt;Password&lt;/label&gt;
              &lt;input type="password" name="pass" id="id_1723"&gt;&lt;br/&gt;
              &lt;input type="submit" onclick="return doValidate();" value="Log In"&gt;
              &lt;input type="submit" name="cancel" value="Cancel"&gt;
          &lt;/form&gt;
  </code></pre>
  
  <p>Hi everyone, I'm learning PHP in a class, and I'm stuck on understanding what this code actually means. We were required to remove the $stored_hash that was once in the login.php file. Currently, we just have the $salt (line 12). </p>
  
  <p>With this change, line 34 is confusing me. When I change $stored_hash to just $salt, I cannot get my login to work. It always says 'incorrect password' of which I don't even know where this is coming from.</p>
  
  <p>Can anyone help explain line 12 and 34? I simply want the password to match the salt so the user can login. Any help is appreciated to a newbie like me, thanks.</p>