title: Creating a PHP/MySQL application - all login attempts fail
body: <p>I'm creating a web application with PHP and MySQL. I have a register/login page set up. I have registered several accounts via the application, and I see the message saying the account has been created successfully, but when I attempt to login, it fails with an "Invalid username or password" error message. 
  When I go to PHPMyAdmin, I can see that all the user accounts are present within the users table, and I can see the usernames and their passwords (the latter is in hashed format).  So I don't understand why I can't log in.</p>
  
  <p>This is my login form (in index.php):</p>
  
  <pre><code>&lt;!-- login form --&gt;
      &lt;form method="post" action="php/login.php"&gt;
        &lt;div class="form-group"&gt;
          &lt;input class="form-control" type="text" name="username" placeholder="Username" required&gt;
        &lt;/div&gt;
  
        &lt;div class="form-group"&gt;
          &lt;input class="form-control" type="password" name="password" placeholder="Password" required&gt;
        &lt;/div&gt;
  
        &lt;div class="form-group"&gt;
          &lt;input class="btn btn-primary" type="submit" name="login" value="Login"&gt;
        &lt;/div&gt;
      &lt;/form&gt;
   &lt;!-- ./login form --&gt;
  </code></pre>
  
  <p>and this is login.php:</p>
  
  <pre><code> &lt;?php
    require_once "../functions.php";
  
    db_connect();
  
    $sql = "SELECT id, username, password FROM users WHERE username = ?";
  
    $statement = $conn-&gt;prepare($sql);
    $statement-&gt;bind_param('s', $_POST['username']);
    $statement-&gt;execute();
    $statement-&gt;store_result();
    $statement-&gt;bind_result($id, $username, $password);
    $statement-&gt;fetch();
  
    if ($statement-&gt;execute()) {
      if(password_verify($_POST['password'], $password)) {
        $_SESSION['user_id'] = $id;
        $_SESSION['user_username'] = $username;
        redirect_to("/home.php");
      } else {
        redirect_to("/index.php?login_error=true");
      }
    } else {
      echo "Error: " . $conn-&gt;error;
    }
    ?&gt;
  </code></pre>
  
  <p>This is the code for the error message (in index.php):</p>
  
  <pre><code>&lt;?php if(isset($_GET['login_error'])): ?&gt;
  &lt;div class="alert alert-danger"&gt;
    &lt;p&gt;Invalid username or password!&lt;/p&gt;
  &lt;/div&gt;
  </code></pre>
  
    
  
  <p>In the Apache access.log, I can see:
  127.0.0.1 - - [26/Aug/2018:14:54:07 +0100] "GET /index.php?login_error=true HTTP/1.1" 200 1230 "<a href="http://localhost/index.php?registered=true" rel="nofollow noreferrer">http://localhost/index.php?registered=true</a>" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0"</p>