Password is incorrect keeps appearing, although username and password are correct and saved in database
<pre><code>&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"&gt;
&lt;html lang="en" &gt;
&lt;head&gt;
 &lt;title&gt;Login | JM Today &lt;/title&gt;
 &lt;link href="Mainstyles.css" type="text/css" rel="stylesheet" /&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;div class="container"&gt;
 &lt;?php include("header.php"); ?&gt;
 &lt;?php include("navbar.php"); ?&gt;
 &lt;?php include("cleanquery.php") ?&gt;  

 &lt;div id="wrap"&gt;


  &lt;?php 
  $check=checklogin();
  if($check == true){
   confirmcookie($_SESSION['username'], $_SESSION['password']);
  } 

  ?&gt;

  &lt;?php

  $conn=mysql_connect("localhost", "***", "***") or die(mysql_error());
  mysql_select_db('jmtdy', $conn) or die(mysql_error());

  function checklogin() {
   if(isset($_COOKIE['cookname']) &amp;&amp; isset($_COOKIE['cookpass'])){

        $_SESSION['username'] = $_COOKIE['cookname'];
        $_SESSION['password'] = $_COOKIE['cookpass'];
        return true;
      }

      elseif(isset($_POST['sublogin'])){
       if((strlen($_POST['user']) &gt; 3) &amp;&amp; (strlen($_POST['pass']) &gt; 3)){
        $user=cleanQuery($_POST['user']);
        $pass=cleanQuery($_POST['pass']);
        $result=mysql_query("select password from users where username='$user' and active='1'");

        if(mysql_num_rows(mysql_query("select username from users where username='$user' and active = '1'" ) &lt; 1)){
         $msg='&lt;p class="statusmsg"&gt;The username you entered is incorrect, or you haven\'t yet activated your account. Please try again.&lt;/p&gt;&lt;br/&gt;';
         $status="NOTOK";
        }
       }

       else{
        $msg=$msg.'&lt;p class="statusmsg"&gt;You didn\'t fill in the required fields.&lt;/p&gt;&lt;br/&gt;';
        $status="NOTOK";
       } 


       if($status != "NOTOK"){

        if(mysql_num_rows(mysql_query("select password from users where password='$pass'" ))){
      $_SESSION['username']=$user;
         $_SESSION['password']=$password;
        }
        else{
         $msg=$msg.'&lt;p class="statusmsg"&gt;The password you entered is incorrect.&lt;/p&gt;';
         $status="NOTOK";

         }

        if(isset($_POST['remember'])){
         setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/");
          setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/");
         }
        }
        if($status=="NOTOK"){
         echo $msg . '&lt;input type="button" value="Retry" onClick="location.href='."'login.php'\"&gt;";
         }
        else{
         echo '&lt;p class="statusmsg"&gt; You have succesfully logged in! &lt;/p&gt;'; 
         }
       }
       else{
        echo '&lt;p class="statusmsg"&gt; You came here by mistake, didn\'t you? &lt;/p&gt;';
       }

      } 


      function confirmcookie($username, $password){

     $result = mysql_query("select password from users where username = '$username'");

     if(!$result || (mysql_num_rows($result) &lt; 1)){
      unset($_SESSION['username']);
      unset($_SESSION['password']);
        $msg='&lt;p class="statusmsg"&gt;The username you entered is incorrect or you have set an incorrect cookie&lt;/p&gt;';
        $status=="NOTOK";
     }

     $dbarray = mysql_fetch_array($result);
     $dbarray['password']  = cleanQuery($dbarray['password']);
     $password = cleanQuery($password);

     if($password!=$dbarray['password']){
        unset($_SESSION['username']);
        unset($_SESSION['password']);
        $msg='&lt;p class="statusmsg"&gt;The password you entered is incorrect or you have set an incorrect cookie.&lt;/p&gt;'; 
     }
     if(count_chars($msg) &gt;0){
      echo $msg;
      }
  }



  ?&gt;
  &lt;/div&gt;
  &lt;br/&gt;
  &lt;br/&gt;
&lt;?php include("footer.php") ?&gt;
&lt;/div&gt;
&lt;/body&gt;

&lt;/html&gt;
</code></pre>

<p>and here is the cleanQuery function:</p>

<pre><code>&lt;?php
function cleanQuery($string)
{
  if(get_magic_quotes_gpc())  // prevents duplicate backslashes
  {
    $string = stripslashes($string);
  }
  if (phpversion() &gt;= '4.3.0')
  {
    $string = mysql_real_escape_string($string);
  }
  else
  {
    $string = mysql_escape_string($string);
  }
  return $string;
}

?&gt;
</code></pre>
