$query = "SELECT user_id, login, password, salt FROM user WHERE login = '$login';";

            $result = mysql_query($query);
        $userData = mysql_fetch_array($result, MYSQL_ASSOC);
            $hash = hash('sha256', $userData['salt'] . hash('sha256', $password));



            if ($hash != $userData['password']) {
                echo '<p>Incorrect password.</p>';
            } else { /* redirect */
        }