mysql and security [duplicate] - php

Question

This question already has an answer here:
Closed 11 years ago.
Possible Duplicate:
fail execute statement with php and mysql
I have this statement taking output out of the database:
function ValidateLogin($user_name, $pass)
{
$user_name=SanitizeString($user_name);
$pass=SanitizeString($pass);
$user_name=mysql_real_escape_string($user_name);
$pass=mysql_real_escape_string($pass);
$salt = 'SHIFLETT';
$password_hash = hash('sha256',$salt.hash('sha256', $pass));
$result=mysql_query("SELECT * FROM users WHERE user_name='$user_name' AND pass='$password_hash' LIMIT 1") or die(mysql_error());
$dataArray=FALSE;
if(mysql_num_rows($result))
{
echo "Login successful".mysql_num_rows($result);
return $dataArray=TRUE;
}
else
{
echo "Login unsuccessful:".mysql_num_rows($result);
}
return $dataArray;
mysql_close();
}
The sanitize function is:
function SanitizeString($var)
{
$var=stripslashes($var);
$var=htmlentities($var, ENT_QUOTES, 'UTF-8');
$var=strip_tags($var);
$var=trim($var);
return $var;
}
Note on the insert I use the same hash algorithm. ... what I get here is always zero:
echo "Login unsuccessful:".mysql_num_rows($result);
Is mysql statement wrong..or is it the hash algorithm? or the sanitizeString function?
UPDATE:
result:
before the $pass is hashed I get this:
string(5) "Mad24"
string(1) "1"
when I insert the name and pass to the database. I get this:
string(5) "Mad24"
string(8) "luckyd55"
Again this is before the pass is hashed on the insert and login of the user. why when I login I get 1?!?!?
\
The login form
echo '
<form action="" method="POST">
<table width="80%" border="1" cellpadding="10" id="navigationBar">
<tr>
<td> Register</td>
<td> Control Panel</td>
<td> Donate </td>
<td align="right">name:<input name="name" type="text" /></td>
<td>password:<input name="pass" type="password" /> <input name="login" type="submit" value="Login" /> </td>
</tr>
</table>
</form>
';

Answer 1

answering to your question in the comments:
You can't improve your site security with hash algorithm.

Answer 2

You can improve your hash/salt usage by creating a different salt for each user, instead of using the same salt for all users.