这个PHP登录代码中的逻辑缺陷在哪里

这段代码中肯定有一个逻辑缺陷，但我找不到。问题是，无论输入如何，它都是echo的成功（模拟重定向到主页）。我不知道为什么。这是代码：

$signIn = new UserService($dbuser, $dbpass, $dbhost, $dbname); //Create new class instance 
$signIn->sec_session_start(); //Begin session
$_SESSION['token'] = $token; //Store token valualbe in super global variable
//***************************************************************************************//
//***************************************************************************************//
//Begin Login Functions
if(isset($_POST['username'], $_POST['password'],$_POST['siteToken'])) {
    //Assign POST submissions to passable php variables
    $username = $_POST['username'];
    $password = $_POST['password'];
    $passedToken = $_POST['siteToken'];
    //Check Token Values (prevent CSRF attacks)
    /*
    if($passedToken != $_SESSION['token']) {
        $error = "CSRF attack detected. Please close your browser and try again."; 
        $signIn->csrfAttackLog($username);
        echo $error;
        exit();     
    }
    */
    //Test if both fields are not null
    if($username == "" || $password = "")
    {
        $error = "Not all fields were entered<br />";
        echo $error;
        exit();
    }
    //Start login process
    else
    {
        $success = $signIn->login($username, $password);
        if ($success == true)
        { //Login Successful
            echo "Success!"; //Direct to main page.
            exit();
        }
        //Specific login failure determination
        else 
        {
            switch ($success){
                case 1:
                    $error = "Your account has been locked.";
                    echo $error;
                    break;
                case 2: 
                    $error = "Invalid Username/Password (2)";
                    echo $error;
                    break;
                case 3:
                    $error = "Invalid Username/Password";
                    echo $error;
                    break;  
                case 4: 
                    $error = "Invalid Username/Password (3)";
                    echo $error;
                    break;
            }
        }
    }

这是login类方法：

    public function login($username, $password)
        {
            //****************//
            $this->username = $username;
            $this->password = $password; 
            $user_Id = "";
            $user = "";
            $hashPassword = "";
            $dbPassword = "";
            $salt = "";
            $userBrowser = "";
            //**************// Local declerations
            $this->connect(); //connect to database
            if ($stmt = $this->dbh->prepare("SELECT UserId, Username, Pass, Salt FROM user WHERE Username = :param1 LIMIT 1")) //Prepared procedure
            {
                $stmt->bindParam(':param1', $this->username); //Bind $this->username to parameter
                $stmt->execute(); //Execute the prepared query
                if ($stmt->rowCount() == 1) //If the user exists
                {
                    $this->user = $stmt->fetch(PDO::FETCH_ASSOC); //Grab the variables from the selected database row
                    $user_Id = $this->user['UserId']; //Transfer variables from array to local variables
                    $user = $this->user['Username'];
                    $dbPassword = $this->user['Pass'];
                    $salt = $this->user['Salt'];
                    if($user_Id = "")
                        echo "Why"; 
                    //Check if account has been locked
                    if($this->checkBrute($user_Id, $this->dbh) == true) 
                    {
                        //Account is locked
                        return 1; //Used in userControl as a switch condition: Indicates a locked account
                        //Possibly send an email here
                    } else {
                                $hashPassword = hash('sha512', $this->password.$salt); //Hash the password with the unique salt
                                if($dbPassword == $hashPassword) 
                                { //Check if the password in the database matches the password the user submitted
                                //Password is correct!
                                $userBrowser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user
                                $_SESSION['p_id'] = $user_Id; //Store user id to global session variable
                                $_SESSION['userName'] = $user; //Store username to global session variable
                                $_SESSION['loginString'] = hash('sha512', $hashPassword.$userBrowser); //Hash the concentanation of the hashedpassword (password + salt) and userBrowser
                                //Login succesful!!!!!!
                                return true;
                                } else {
                                        //Password is not correct
                                        //Record this attempt in the database
                                        $now = time();
                                        $userIp = $_SERVER['REMOTE_ADDR'];
                                        $insert = $this->dbh->query("INSERT INTO loginattempts (UserId, UserIp, EventTime) VALUES ('$user_Id', 'userIP', '$now')");
                                        if($insert == false){
                                            return 2; //Used in userControl as a switch condition: Indicated a failure to log failed login attempt
                                        } else {
                                            return 3; //Used in userControl as a switch condition: Indicates an inccorect password
                                        }
                                    }
                            }
                }
                else 
                {
                    //No user exists
                    return 4;
                }
            }
        }

我知道SQL查询是有效的：我已经在这段代码之外对它们进行了测试。我不明白为什么它一直是真的。PHP没有抛出任何异常或错误（是的，我读过很多次"不要编写自己的登录函数。使用一个已经有效的函数。"这不是一个公共网站。我这样做只是为了好玩）。感谢您的帮助。