title: PHP Error - Login/Register Script
body: <p>The user registration page works, meaning a the salt and hashed password are saved correctly in the database. The login reports an invalid username/password. I have the salt and password set to varchar(64) in the database if that matters.</p>
  
  <p>I just cant seem to find out why it doesn't work. I would like to believe the error is in the $query or $count variable.</p>
  
  <p>Register: </p>
  
  <pre><code>&lt;?php
  include('config.php');
  #Setup Credentials
  $uname = mysql_real_escape_string($_POST['uname']);
  $escapedPW = mysql_real_escape_string($_POST['pass']);
  $email = mysql_real_escape_string($_POST['email']);
  #Salt Credentials
  $salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
  $saltedPW =  $escapedPW . $salt;
  $hashedPW = hash('sha256', $saltedPW);
  #checks and queries
  $usercheck = mysql_query("SELECT * FROM users WHERE username = '$uname'");
  $emailcheck = mysql_query("SELECT * FROM users WHERE email = '$email'");
  $count = mysql_num_rows($usercheck);
  $count2 = mysql_num_rows($emailcheck);
  $query = "INSERT INTO users (username, password, email, salt) VALUES ('$uname', '$hashedPW', '$email', '$salt')";
  $error = "";
  
  if(isset($_POST['submit'])){
      if(empty($_POST['uname']) || empty($_POST['pass']) || empty($_POST['email'] )){
        echo 'A field is empty!';}      
      else{
              if($count != 0){$error = 'Username is already registered.';}
              elseif ($count2 != 0 ) {$error = 'Email is already registered.';}
                  else{ mysql_query($query);}
      }
  }
  ?&gt;
  </code></pre>
  
  <p>Login:</p>
  
  <pre><code>&lt;?php
  include("config.php");
  if (isset($_POST['submit'])) { 
     if (!$_POST['username'] | !$_POST['password'] ) {
      die('You did not complete all of the required fields');
    }
  else{
      $username = mysql_real_escape_string($_POST['username']);
      $escapedPW = mysql_real_escape_string($_POST['password']);
  
      $saltquery = "SELECT salt FROM users WHERE username = '$username';";
      $result = mysql_query($saltquery);
  
      $row = mysql_fetch_assoc($result);
      $salt = $row['salt'];
  
      $saltedPW =  $escapedPW . $salt;
  
      $hashedPW = hash('sha256', $saltedPW);
  
      $query = "SELECT * FROM users WHERE username = '$username' and password = '$hashedPW';";
      $count = mysql_num_rows($query);
  
      if($count == 0){
        header("location:index.php?status=1");
      }
        else {
                // store cookie $myusername, $mypassword and redirect to index
        session_start(); 
        $_SESSION['username'] = $username;
        $_SESSION['password'] = $hashedPW;
        setcookie('username', $username, time()+60 * 60 * 4, '/', 'www.site90.net');
        setcookie('password', $hashedPW, time()+60 * 60 * 4, '/', 'www.site90.net');
        header("location:index.php");
      }
  }}
  ?&gt;
  </code></pre>