title: PHP login check flow
body: <p>Im having trouble with a php login script (below). I want to redirect to nouser.php if someone enters a username that does not exist and to wrongpass.php if the wrong password (but a valid username) is entered. The below code almost works. If I comment out the entire wrong password section then the nouser section works as expected displaying the nouser page , but if I leave the wrong password section in I get the wrongpass.php page for both nouser and wrong password situations. If I put a valid user in but with wrong password then I get wrong password (correct behavior).
  Simply put , how can i make sure that I get redirect to nouser.php if there is nouser of this name and not the wrongpass.php page..</p>
  
  <pre><code>&lt;?php
              $username = $_POST['username'];
  $password = $_POST['password'];
  //connect to the database here
  
  require_once 'includes/login.php';
  $db_server = mysql_connect($db_hostname, $db_username, $db_password);
  if (!$db_server) die("Unable to connect to MySQL: " . mysql_error());
  
  mysql_select_db($db_database, $db_server)
      or die("Unable to select database: " . mysql_error());
  
  
  $username = mysql_real_escape_string($username);
  $query = "SELECT password, salt
          FROM users
          WHERE username = '$username';";
  $result = mysql_query($query);
  //wrong user section
  if(mysql_num_rows($result) &lt; 1) //no such user exists
  {
      header('Location: nouser.php');
  }
  //wrong password section
  $userData = mysql_fetch_array($result, MYSQL_ASSOC);
  $hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
  if($hash != $userData['password']) //incorrect password
  {
      header('Location: wrongpass.php');
  }
  //login successful
  
  
  ?&gt;
  </code></pre>