title: php login script failing
body: <p>I have a login script that was working fine - I exported the db and scripts over locally after making it work online (backward I know) but since the port both online and offline failing to login my dummy account - it will register a new user and salt the passwords fine but when logging in it directs you to the failed page? Not sure why and unsure where it is failing?</p>
  
  <p>Heres my code:</p>
  
  <p>Login form:</p>
  
  <pre><code>&lt;?php
  
  include_once 'includes/db_connect.php';
  include_once 'includes/functions.php';
  
  sec_session_start();
  
  if (login_check($mysqli) == true) {
      $logged = 'in';
  } else {
      $logged = 'out';
  }
  ?&gt;
  </code></pre>
  
  <p>The process script:</p>
  
  <pre><code>&lt;?php
  include_once 'db_connect.php';
  include_once 'functions.php';
  
  sec_session_start(); // Our custom secure way of starting a PHP session.
  
  if (isset($_POST['email'], $_POST['p'])) {
      $email = $_POST['email'];
      $password = $_POST['p']; // The hashed password.
  
      if (login($email, $password, $mysqli) == true) {
          $_SESSION['email'] = $email;
          // Login success 
          header('Location: ../protected_page.php');
      } else {
          // Login failed 
          header('Location: ../index.php?error=1');
      }
  } else {
      // The correct POST variables were not sent to this page. 
      echo 'Invalid Request';
  }
  </code></pre>
  
  <p>An included function script:</p>
  
  <pre><code>&lt;?php
  include_once 'psl-config.php';
  
  function sec_session_start() {
      $session_name = 'sec_session_id';   // Set a custom session name
      $secure = SECURE;
      // This stops JavaScript being able to access the session id.
      $httponly = true;
      // Forces sessions to only use cookies.
      if (ini_set('session.use_only_cookies', 1) === FALSE) {
          header("Location: ../error.php?err=Could not initiate a safe session (ini_set)");
          exit();
      }
      // Gets current cookies params.
      $cookieParams = session_get_cookie_params();
      session_set_cookie_params($cookieParams["lifetime"],
          $cookieParams["path"], 
          $cookieParams["domain"], 
          $secure,
          $httponly);
      // Sets the session name to the one set above.
      session_name($session_name);
      session_start();            // Start the PHP session 
      session_regenerate_id();    // regenerated the session, delete the old one. 
  }
  
  
  
  function login($email, $password, $mysqli) {
      // Using prepared statements means that SQL injection is not possible. 
      if ($stmt = $mysqli-&gt;prepare("SELECT id, username, password, salt 
          FROM members
         WHERE email = ?
          LIMIT 1")) {
          $stmt-&gt;bind_param('s', $email);  // Bind "$email" to parameter.
          $stmt-&gt;execute();    // Execute the prepared query.
          $stmt-&gt;store_result();
  
          // get variables from result.
          $stmt-&gt;bind_result($user_id, $username, $db_password, $salt);
          $stmt-&gt;fetch();
  
          // hash the password with the unique salt.
          $password = hash('sha512', $password . $salt);
          if ($stmt-&gt;num_rows == 1) {
              // If the user exists we check if the account is locked
              // from too many login attempts 
  
              if (checkbrute($user_id, $mysqli) == true) {
                  // Account is locked 
                  // Send an email to user saying their account is locked
                  return false;
              } else {
                  // Check if the password in the database matches
                  // the password the user submitted.
                  if ($db_password == $password) {
                      // Password is correct!
                      // Get the user-agent string of the user.
                      $user_browser = $_SERVER['HTTP_USER_AGENT'];
                      // XSS protection as we might print this value
                      $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                      $_SESSION['user_id'] = $user_id;
                      // XSS protection as we might print this value
                      $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                                  "", 
                                                                  $username);
                      $_SESSION['username'] = $username;
                      $_SESSION['login_string'] = hash('sha512', 
                                $password . $user_browser);
                      // Login successful.
                      return true;
                  } else {
                      // Password is not correct
                      // We record this attempt in the database
                      $now = time();
                      $mysqli-&gt;query("INSERT INTO login_attempts(user_id, time)
                                      VALUES ('$user_id', '$now')");
                      return false;
                  }
              }
          } else {
              // No user exists.
              return false;
          }
      }
  }
  
  function checkbrute($user_id, $mysqli) {
      // Get timestamp of current time 
      $now = time();
  
      // All login attempts are counted from the past 2 hours. 
      $valid_attempts = $now - (2 * 60 * 60);
  
      if ($stmt = $mysqli-&gt;prepare("SELECT time 
                               FROM login_attempts &lt;code&gt;&lt;pre&gt;
                               WHERE user_id = ? 
                              AND time &gt; '$valid_attempts'")) {
          $stmt-&gt;bind_param('i', $user_id);
  
          // Execute the prepared query. 
          $stmt-&gt;execute();
          $stmt-&gt;store_result();
  
          // If there have been more than 5 failed logins 
          if ($stmt-&gt;num_rows &gt; 5) {
              return true;
          } else {
              return false;
          }
      }
  }
  
  function login_check($mysqli) {
      // Check if all session variables are set 
      if (isset($_SESSION['user_id'], 
                          $_SESSION['username'], 
                          $_SESSION['login_string'])) {
  
          $user_id = $_SESSION['user_id'];
          $login_string = $_SESSION['login_string'];
          $username = $_SESSION['username'];
  
          // Get the user-agent string of the user.
          $user_browser = $_SERVER['HTTP_USER_AGENT'];
  
          if ($stmt = $mysqli-&gt;prepare("SELECT password 
                                        FROM members 
                                        WHERE id = ? LIMIT 1")) {
              // Bind "$user_id" to parameter. 
              $stmt-&gt;bind_param('i', $user_id);
              $stmt-&gt;execute();   // Execute the prepared query.
              $stmt-&gt;store_result();
  
              if ($stmt-&gt;num_rows == 1) {
                  // If the user exists get variables from result.
                  $stmt-&gt;bind_result($password);
                  $stmt-&gt;fetch();
                  $login_check = hash('sha512', $password . $user_browser);
  
                  if ($login_check == $login_string) {
                      // Logged In!!!! 
                      return true;
                  } else {
                      // Not logged in 
                      return false;
                  }
              } else {
                  // Not logged in 
                  return false;
              }
          } else {
              // Not logged in 
              return false;
          }
      } else {
          // Not logged in 
          return false;
      }
  }
  
  function esc_url($url) {
  
      if ('' == $url) {
          return $url;
      }
  
      $url = preg_replace('|[^a-z0-9-~+_.?#=!&amp;;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
  
      $strip = array('%0d', '%0a', '%0D', '%0A');
      $url = (string) $url;
  
      $count = 1;
      while ($count) {
          $url = str_replace($strip, '', $url, $count);
      }
  
      $url = str_replace(';//', '://', $url);
  
      $url = htmlentities($url);
  
      $url = str_replace('&amp;amp;', '&amp;#038;', $url);
      $url = str_replace("'", '&amp;#039;', $url);
  
      if ($url[0] !== '/') {
          // We're only interested in relative links from $_SERVER['PHP_SELF']
          return '';
      } else {
          return $url;
      }
  }
  </code></pre>
  
  <p>I have tried backtracking but nothing I am changing is working and I feel like I maybe doing more harm than good!</p>