title: Checking if Username and Password are correct
body: <p>As my code is right now, I always get the <code>echo "Username/Password incorrect.";</code> whether or not the username/password match or not. My question is, What did I do wrong in the code below for the php to always echo "Username/Password incorrect"</p>
  
  <pre><code>&lt;?php
  require 'privstuff/dbinfo.php';
  
  $password1 = $_POST["password1"];
  $username = $_POST["username"];
  
  $mysqli = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_DATABASE);
  
  
  if(mysqli_connect_errno()) {
      echo "Connection Failed. Please send an email to owner@othertxt.com regarding this problem.";
      exit();
  }
  
  if ($stmt = $mysqli-&gt;prepare("SELECT username, password FROM accounts WHERE username=? and password=?")) {
  
      $db_pw = password_hash($password1, PASSWORD_BCRYPT);
  
      $stmt-&gt;bind_param("ss", $username, $db_pw);
      $stmt-&gt;execute();
      if ($stmt-&gt;affected_rows &gt; 0) {
  
          echo "Logged in.";
      }else{
          echo "Username/Password incorrect.";
      }
      $stmt-&gt;close();
  }
  $stmt-&gt;close();
  
  $mysqli-&gt;close(); 
  
  ?&gt;
  </code></pre>
  
  <p><strong>Update</strong> I've changed <code>if ($stmt-&gt;affected_rows &gt; 0)</code> to <code>if ($stmt-&gt;num_rows)</code>. Still doesn't work though
  <strong>UPDATE 2</strong> I've realized the issue is me using  <code>password_hash($password1, PASSWORD_BCRYPT);</code> I didn't realize that the hash gives different strings every time. I'm not understanding on how to use password_verify</p>