用户密码经过散列和加盐处理，试图允许用户在前端更改密码

起初密码更改是有效的，但当我添加hash和salt时，现在用户无法更改密码（不断获取：当前密码不正确）

if (count($_POST)>0) {
$result = mysql_query("SELECT * from users WHERE username='"
.$_SESSION["user"] . "'");
$row=mysql_fetch_array($result);
    if($_POST["currentPassword"] == $row["password"]) {
mysql_query("UPDATE users set password='" . $_POST["newPassword"] . "'  
WHERE username='" . $_SESSION["user"] . "'");
$message = "Password Changed";
}   else $message = "Current Password is not correct";
}

这是注册页面：

session_start();
    if($_SESSION['user']!=''){header("Location:welcome.php");}
$dbh=new PDO('mysql:dbname=doctor;localhost', 'root', '');
$email=$_POST['mail'];
$password=$_POST['pass'];
    if(isset($_POST) && $email!='' && $password!=''){
$sql=$dbh->prepare("SELECT id,password,psalt FROM users WHERE 
username=?");
$sql->execute(array($email));
      while($r=$sql->fetch()){
$p=$r['password'];
$p_salt=$r['psalt'];
$id=$r['id'];
}
$site_salt="mysalt";/
$salted_hash = hash('sha256',$password.$site_salt.$p_salt);
    if($p==$salted_hash){
    $_SESSION['user']=$id;
    header("Location:welcome.php");
       }else{
 echo "Username OR Password is Incorrect...";
}
}

这是JavaScript：

function validatePassword() {
var currentPassword,newPassword,confirmPassword,output = true;
currentPassword = document.frmChange.currentPassword;
newPassword = document.frmChange.newPassword;
confirmPassword = document.frmChange.confirmPassword;
if(!currentPassword.value) {
currentPassword.focus();
document.getElementById("currentPassword").innerHTML = "required";
output = false;
}
else if(!newPassword.value) {
newPassword.focus();
document.getElementById("newPassword").innerHTML = "required";
output = false;
}
else if(!confirmPassword.value) {
confirmPassword.focus();
document.getElementById("confirmPassword").innerHTML = "required";
output = false;
}
if(newPassword.value != confirmPassword.value) {
newPassword.value="";
confirmPassword.value="";
newPassword.focus();
document.getElementById("confirmPassword").innerHTML = "not same";
output = false;
}   
return output;
}