New Halley Code

<?php
$host = 'host';
$database = 'database';
$user = 'root';
$pass_host = '';

/* Ésta siempre va a ser la respuesta */
/* JSON RESPONSE: error | extra */
/* error {error, message} */

$json = array();
$json["error"]["error"] == False;

if(!isset($_GET['mail']) || !isset($_GET['pas'])) {
    $json["error"]["error"] == True;
    $json["error"]["message"] == "Missing parameters";
    die(json_encode($json));
}

$email = $_GET['mail'];
$pas = $_get['pas'];
/* TIP: Más seguro que sha1, y para verificar: password_verify($pass, $dbpass) */
$pass = password_hash($pass, PASSWORD_BCRYPT);

$conexion = new mysqli($host, $user, $pass_host, $database);

$res = mysqli->query("SELECT * FROM user WHERE email='$email'");

if(!$res) {
    $json["error"]["error"] = True;
    $json["error"]["message"] = "Failed to execute query";
    die(json_encode($response));
}

$user = $res->data_seek(0)->fetch_assoc();

if(!password_verify($user["password"], $dbpass)) {
    $json["error"]["error"] = True;
    $json["error"]["message"] = "Incorrect login";
    die(json_encode($response));
}

$json["extra"]["user"] = $user;

echo json_encode($json);

?>