登录检查功能总是给出错误的结果

Question

我认为我的代码没有任何错误，因为我根本没有错误 这是我的登录检查功能，不断给出错误的结果。

function login_check($mysqli) {
// Check if all session variables are set 
if (isset($_SESSION['user_id'], 
                    $_SESSION['username'], 
                    $_SESSION['login_string'])) {

    $user_id = $_SESSION['user_id'];
    $login_string = $_SESSION['login_string'];
    $username = $_SESSION['username'];

    // Get the user-agent string of the user.
    $user_browser = $_SERVER['HTTP_USER_AGENT'];

    if ($stmt = $mysqli->prepare("SELECT password 
                                  FROM members 
                                  WHERE id = ? LIMIT 1")) {
        // Bind "$user_id" to parameter. 
        $stmt->bind_param('i', $user_id);
        $stmt->execute();   // Execute the prepared query.
        $stmt->store_result();

        if ($stmt->num_rows == 1) {
            // If the user exists get variables from result.
            $stmt->bind_result($password);
            $stmt->fetch();
            $login_check = hash('sha512', $password . $user_browser);

            if ($login_check == $login_string) {
                // Logged In!!!! 
                return true;
            } else {
                // Not logged in 
                return false;
            }
        } else {
            // Not logged in 
            return false;
        }
    } else {
        // Not logged in 
        return false;
    }
} else {
    // Not logged in 
    return false;
}
}
function login($email, $password, $mysqli) {
// Using prepared statements means that SQL injection is not possible. 
if ($stmt = $mysqli->prepare("SELECT id, username, password, salt 
    FROM members
   WHERE email = ?
    LIMIT 1")) {
    $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
    $stmt->execute();    // Execute the prepared query.
    $stmt->store_result();

    // get variables from result.
    $stmt->bind_result($user_id, $username, $db_password, $salt);
    $stmt->fetch();

    // hash the password with the unique salt.
    $password = hash('sha512', $password . $salt);
    if ($stmt->num_rows == 1) {
        // If the user exists we check if the account is locked
        // from too many login attempts 

        if (checkbrute($user_id, $mysqli) == true) {
            // Account is locked 
            // Send an email to user saying their account is locked
            return false;
        } else {
            // Check if the password in the database matches
            // the password the user submitted.
            if ($db_password == $password) {
                // Password is correct!
                // Get the user-agent string of the user.
                $user_browser = $_SERVER['HTTP_USER_AGENT'];
                // XSS protection as we might print this value
                $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                $_SESSION['user_id'] = $user_id;
                // XSS protection as we might print this value
                $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                            "", 
                                                            $username);
                $_SESSION['username'] = $username;
                $_SESSION['login_string'] = hash('sha512', 
                          $password . $user_browser);
                // Login successful.
                return true;
            } else {
                // Password is not correct
                // We record this attempt in the database
                $now = time();
                $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                VALUES ('$user_id', '$now')");
                return false;
            }
        }
    } else {
        // No user exists.
        return false;
    }
}

}

这是我的进程登录文件，我的表单，以及检查我是否已登录的文件     

sec_session_start(); // Our custom secure way of starting a PHP session.

if (isset($_POST['email'], $_POST['p'])) {
$email = $_POST['email'];
$password = $_POST['p']; // The hashed password.

if (login($email, $password, $mysqli) == true) {
    // Login success 
    header('Location: ../protected_page.php');
} else {
    // Login failed 
    header('Location: ../index.php?error=1');
}
} else {
    // The correct POST variables were not sent to this page. 
    echo 'Invalid Request';
}


THIS IS THE FORM <form action="includes/process_login.php" method="post" name="login_form">                      
        Email: <input type="text" name="email" />
        Password: <input type="password" 
                         name="password" 
                         id="password"/>
        <input type="button" 
               value="Login" 
               onclick="formhash(this.form, this.form.password);" /> 
    </form>

<?php
include_once 'db_connect.php';
include_once 'functions.php';

sec_session_start(); // Our custom secure way of starting a PHP session.

if (isset($_POST['email'], $_POST['p'])) {
$email = $_POST['email'];
$password = $_POST['p']; // The hashed password.

if (login($email, $password, $mysqli) == true) {
    // Login success 
    header('Location: ../protected_page.php');
} else {
    // Login failed 
    header('Location: ../index.php?error=1');
}
} else {
// The correct POST variables were not sent to this page. 
echo 'Invalid Request';
}

请帮帮我，我一直在找几个小时，我不知道问题是什么。