存储的散列密码和散列输入密码之间的比较

Question

我目前正在为我的网站登录系统， 我有2个文件

sign_up.php

function createSalt(){
        $key = md5(uniqid(rand(), TRUE));
        return substr($key, 0, 22);
}

    $salt      = createSalt();
    $hash      = hash("sha256", $password);
    $password  = hash("sha256", $salt.$hash);
    $userLevel = '1';

    $sql = "INSERT INTO users (username, email, password, salt, dob, userLevel)
            VALUES (?,?,?,?,?,?)";

        if ($stmt = mysqli_prepare($conn, $sql)) {
                    mysqli_stmt_bind_param($stmt, "sssssi", $username, $email, $password, 
                                           $salt, $birthdate, $userLevel);
                    mysqli_stmt_execute($stmt);
                    mysqli_stmt_close($stmt);
        }

和sign_in.php

if (isset($_POST['username']))
    $username  = sanitize($_POST['username']);
if (isset($_POST['password']))
    $password  = sanitize($_POST['password']);

$sql = "SELECT * 
                        FROM users
                        WHERE username = '$username'";

                $queryresult = mysqli_query($conn, $sql);


                if (!$queryresult) 
                      echo "Unable to query table". mysqli_error();
                else{
                      //get the data from database
                      while($row = mysqli_fetch_array($queryresult)) {
                            $salt       = $row['salt']; //salt retrieved from the database
                            $dbpassword = $row['password']; //password retrieved from the database
                            $finalhash  = hash("sha256", $password);
                            $finalhash1 = hash("sha256", $salt.$finalhash);

                            //check the password inputed by user to the database
                            if ($finalhash1 == $dbpassword){
                                    $_SESSION['username'] = $username;
                                    $_SESSION['password'] = $password;
                                    echo "Hi $row[1], you are now logged in as $row[3]";
                                    die ("<p><a href=administrator_page.php>Click here to continue</a></p>");
                             }

                             else
                                echo "<h2> Invalid username/password combination \n</h2>";

我不知道为什么来自用户输入的哈希密码总是有额外的价值 我试图回应它，这就是结果：

f0b2dbf93305ce2eef8f5a1f45ab8b1046a7b9ba8ee2f305c3 --> stored password in mySQL
f0b2dbf93305ce2eef8f5a1f45ab8b1046a7b9ba8ee2f305c3f2fce10d5f199f --> inputed password from user

是的，有人能帮帮我吗？非常感谢谢谢！