Login Password Comparison Questions

The Database Save field is MD5 (password), the form receives processing the password is MD5 (password + suffix), these two judgments return the logical value is true? Why I tried last night, return the account password is not correct, but the Ajax return value is OK, if all disorderly input, then Ajax returned is null. If the password does not match why Ajax returns OK? If the match why is the return password incorrect? Where is the problem?
1.indexcontroller.class.php:

 !--? phpnamespace Home\controller;use think\controller;class  Indexcontroller extends Controller {public Function index () {$this--->display ();    Public Function Checkusername () {if (!is_ajax) {$data =array (' errmsg ' = ' illegal access method ');    } $userName =i (' userName ', ' ', ' htmlspecialchars ');    $userPass =i (' userpass ', ' ', ' htmlspecialchars ');    $userInfo =d ("Stuser")->getuserinfo ($userName); if ($userInfo [' Userpass ']!=handlemd5pass ($userPass)) {//echo $userInfo [' Userpass ']. "      
 ";      echo Handlemd5pass ($userPass);      echo "username or password is incorrect";    Var_dump (Handlemd5pass ($userPass));      } if ($userInfo) {//$userInfo->where (Array (' id ' = = $userInfo [' id ']))->save ($ERRMSG);      Session (' UserId ', $userInfo [' id ']);    $data =array (' info ' = ' OK ', ' callback ' = '/stfjzd-13/index.php/home/index/index ');  } $this->ajaxreturn ($data); }}

2.stusermodel.class.php

  
   DB=M("Stuser");    }    //数据库中检索用户数据，find()检索一条->Index    public function getUserInfo($userName){      //$res=$this->DB->field('username','userpass')->where('username="'.$userName.'"')->find();      $userInfo=$this->DB->where('username="'.$userName.'"')->find();      echo $this->DB->getLastSql();      return $userInfo;    }  }?>

3.login.js

$('.search_sub').click(function(event){  event.preventDefault();  var userName=$("#username").val();  var userPass=$("#userpass").val();  if(userPass=="" || userName==""){    alert("登陆名称与密码不能为空");    $("#username").focus();    return false;  }else{    var url="/stfjzd-13/index.php/Home/Index/checkUserName";    //var url="{U('/stfjzd-13/index.php/Home/Index/checkUserName')}";    $.post(url,{username:userName,userpass:userPass},function(msg){      if(msg.errMsg=="ok"){        window.location.href=msg.callback;      }else{        alert(msg.errMsg);      }    },"JSON")  }})

Reply content:

The Database Save field is MD5 (password), the form receives processing the password is MD5 (password + suffix), these two judgments return the logical value is true? Why I tried last night, return the account password is not correct, but the Ajax return value is OK, if all disorderly input, then Ajax returned is null. If the password does not match why Ajax returns OK? If the match why is the return password incorrect? Where is the problem?
1.indexcontroller.class.php:

 !--? phpnamespace Home\controller;use think\controller;class  Indexcontroller extends Controller {public Function index () {$this--->display ();    Public Function Checkusername () {if (!is_ajax) {$data =array (' errmsg ' = ' illegal access method ');    } $userName =i (' userName ', ' ', ' htmlspecialchars ');    $userPass =i (' userpass ', ' ', ' htmlspecialchars ');    $userInfo =d ("Stuser")->getuserinfo ($userName); if ($userInfo [' Userpass ']!=handlemd5pass ($userPass)) {//echo $userInfo [' Userpass ']. "      
 ";      echo Handlemd5pass ($userPass);      echo "username or password is incorrect";    Var_dump (Handlemd5pass ($userPass));      } if ($userInfo) {//$userInfo->where (Array (' id ' = = $userInfo [' id ']))->save ($ERRMSG);      Session (' UserId ', $userInfo [' id ']);    $data =array (' info ' = ' OK ', ' callback ' = '/stfjzd-13/index.php/home/index/index ');  } $this->ajaxreturn ($data); }}

2.stusermodel.class.php

  
   DB=M("Stuser");    }    //数据库中检索用户数据，find()检索一条->Index    public function getUserInfo($userName){      //$res=$this->DB->field('username','userpass')->where('username="'.$userName.'"')->find();      $userInfo=$this->DB->where('username="'.$userName.'"')->find();      echo $this->DB->getLastSql();      return $userInfo;    }  }?>

3.login.js

$('.search_sub').click(function(event){  event.preventDefault();  var userName=$("#username").val();  var userPass=$("#userpass").val();  if(userPass=="" || userName==""){    alert("登陆名称与密码不能为空");    $("#username").focus();    return false;  }else{    var url="/stfjzd-13/index.php/Home/Index/checkUserName";    //var url="{U('/stfjzd-13/index.php/Home/Index/checkUserName')}";    $.post(url,{username:userName,userpass:userPass},function(msg){      if(msg.errMsg=="ok"){        window.location.href=msg.callback;      }else{        alert(msg.errMsg);      }    },"JSON")  }})

    if($userInfo['userpass']!=handleMd5Pass($userPass)){        //此处只echo了错误，但是没有返回到前端。      echo "用户名或密码不正确";      //var_dump(handleMd5Pass($userPass));    }    if($userInfo){        //你的代码运行到这里，用户名对，所以查出了userInfo，所以返回了ok。正确应该在密码验证错误的时候就返回给前端，不再往后运行      session('userId',$userInfo['id']);      $data=array(        'info' => 'ok',        'callback' => U('/stfjzd-13/index.php/Home/Index/index')      );    }    $this->ajaxReturn($data);

In the comment

echo "username or password is incorrect";

return here

