Phpass Hashed password checking

Question

I have been developing my own social network for the past 3 weeks and I am using phpass to hash up the passwords into storage into my database using the following code snippet...

// END FORM DATA ERROR HANDLING
// Begin Insertion of data into the database

require("php_includes/PasswordHash.php");
$hasher = new PasswordHash(8,false);
$p_hash = $hasher->HashPassword($p);
if (strlen($p_hash)>=20){

    // Add user info into the database table for the main site table
    $sql = "INSERT INTO users (username, email, password, gender, country, ip, signup, lastlogin, notescheck)       
            VALUES('$u','$e','$p_hash','$g','$c','$ip',now(),now(),now())";
    $query = mysqli_query($db_conx, $sql); 
    $uid = mysqli_insert_id($db_conx);

The small problem I have is on my login page where I have a simple form and this following code block at the top of my page...

include_once("php_includes/check_login_status.php");
// If user is already logged in, header that weenis away
if($user_ok == true){
    header("location: user.php?u=".$_SESSION["username"]);
    exit();
}
// AJAX CALLS THIS LOGIN CODE TO EXECUTE
if(isset($_POST["e"])){
    // CONNECT TO THE DATABASE
    include_once("php_includes/db_conx.php");
    // GATHER THE POSTED DATA INTO LOCAL VARIABLES AND SANITIZE
    $e = mysqli_real_escape_string($db_conx, $_POST['e']);
    require('php_includes/PasswordHash.php');
    $hasher = new PasswordHash(8, FALSE);
    $hash = $hasher->HashPassword($p);
    $checked = $hasher->CheckPassword($p, $hash);
    $p = $_POST["p"];
    // GET USER IP ADDRESS
    $ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));
    // FORM DATA ERROR HANDLING
    if($e == "" || $p == ""){
        echo "login_failed";
        exit();
    } else {
    // END FORM DATA ERROR HANDLING
        $sql = "SELECT id, username, password FROM users WHERE email='$e' AND activated='1' LIMIT 1";
        $query = mysqli_query($db_conx, $sql);
        $row = mysqli_fetch_row($query);
        $db_id = $row[0];
        $db_username = $row[1];
        $db_pass_str = $row[2];
        if($p != $db_pass_str){
            echo "login_failed";
            exit();
        } else {
            // CREATE THEIR SESSIONS AND COOKIES
            $_SESSION['userid'] = $db_id;
            $_SESSION['username'] = $db_username;
            $_SESSION['password'] = $db_pass_str;
            setcookie("id", $db_id, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("user", $db_username, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("pass", $db_pass_str, strtotime( '+30 days' ), "/", "", "", TRUE); 
            // UPDATE THEIR "IP" AND "LASTLOGIN" FIELDS
            $sql = "UPDATE users SET ip='$ip', lastlogin=now() WHERE username='$db_username' LIMIT 1";
            $query = mysqli_query($db_conx, $sql);
            echo $db_username;
            exit();
        }
    }
    exit();
}

Basically whats happening is that I am getting an error message when trying to log in! Anyone got any ideas?

Cheers for the answers have channged it up like this...

?><?php
// AJAX CALLS THIS LOGIN CODE TO EXECUTE
if(isset($_POST["e"])){
    // CONNECT TO THE DATABASE
    include_once("php_includes/db_conx.php");
    // GATHER THE POSTED DATA INTO LOCAL VARIABLES AND SANITIZE
    $e = mysqli_real_escape_string($db_conx, $_POST['e']);
    require('php_includes/PasswordHash.php');
    $hasher = new PasswordHash(8, FALSE);
    $hash = $hasher->HashPassword($p);
    $checked = $hasher->CheckPassword($p, $hash);
    $hash = $_POST["p"];
    // GET USER IP ADDRESS
    $ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));
    // FORM DATA ERROR HANDLING
    if($hash != $db_pass_str){//and not $p != $dp_pass_str
       echo "login_failed";
       exit();
    } else {
    // END FORM DATA ERROR HANDLING
        $sql = "SELECT id, username, password FROM users WHERE email='$e' AND activated='1' LIMIT 1";
        $query = mysqli_query($db_conx, $sql);
        $row = mysqli_fetch_row($query);
        $db_id = $row[0];
        $db_username = $row[1];
        $db_pass_str = $row[2];
            // CREATE THEIR SESSIONS AND COOKIES
            $_SESSION['userid'] = $db_id;
            $_SESSION['username'] = $db_username;
            $_SESSION['password'] = $db_pass_str;
            setcookie("id", $db_id, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("user", $db_username, strtotime( '+30 days' ), "/", "", "", TRUE);
            setcookie("pass", $db_pass_str, strtotime( '+30 days' ), "/", "", "", TRUE); 
            // UPDATE THEIR "IP" AND "LASTLOGIN" FIELDS
            $sql = "UPDATE users SET ip='$ip', lastlogin=now() WHERE username='$db_username' LIMIT 1";
            $query = mysqli_query($db_conx, $sql);
            echo $db_username;
            exit();
        }
    exit();
}
?>

But am still getting a login error

Answer 1

You're setting $p as the POST password (unhashed)

$p = $_POST["p"];

Looks like it should then be:

 if($hash != $db_pass_str){         //and not $p != $dp_pass_str
  echo "login_failed";

i.e. compare the hashed password stored with the password entered and hashed (so to compare the two hashes)