Receiving PHP errors when attempting to connect to database

Question

I am very confused, Not so long ago I was told that i need to hash my passwords which I think I have done, I looked at a separate overflow question found here How to use PHP's password_hash to hash and verify passwords

But sadly I tried adding it to my code and nothing seems to work, Another thing I was told was to add http://php.net/manual/en/mysqli.construct.php Which confused me even more. I feel like none of my code is done correctly, I feel like a complete idiot for not knowing any of this, I am truly sorry. I asked my teacher who did PHP 4 years ago but sadly she had no idea either. I really want to get better at coding but I feel like i dont know any of this. I have really tried my hardest to do it without asking on overflow because I feel like im doing everything wrong :/.

I have tried to do a lot of research on the php website and I've looked everywhere for possible answers on how i am meant to add mysqli_construct. Also apparently I have a chance of getting my code injected. I know this is probably really simple to fix but I am utterly confused by everything,

-Code-

index.php

<?php
   include("database.php");
   session_start();
 
   if($_SERVER["REQUEST_METHOD"] == "POST") {
       
      // Create querystring
       
      $sql = "SELECT id, password FROM admin WHERE username = ?";
 
      // Prepare, bind, execute
       
      $stmt = mysqli_prepare($db,$sql);
      mysqli_stmt_bind_param($stmt, 's', $_POST['username']);
      mysqli_stmt_execute($stmt);
      mysqli_stmt_bind_result($stmt, $user_id, $user_password);
      if (mysqli_stmt_fetch($stmt)) {
          
         // Validate password
          
         if (password_verify($_POST['password'], $user_password)) {
             session_register("username");
             $_SESSION['login_user'] = $username;
 
             header("location: myaccount.php");
            exit;
         } else {
             $error = "Your Login Name or Password is invalid";
         }
      mysqli_stmt_close($stmt);
      } else {
         $error = "Your Login Name or Password is invalid";
      }
   }
?>

database.php

<?php

$host = 'localhost';
$user = '-';
$pass = '-';
$db = 'database';
$mysqli = new mysqli($host,$user,$pass,$db) or die($mysqli->error);

?>

My error log

[15-Jul-2017 05:29:20 America/New_York] PHP Warning:  mysqli_prepare() expects parameter 1 to be mysqli, string given in /home/beaskxxb/public_html/index.php on line 10
[15-Jul-2017 05:29:20 America/New_York] PHP Warning:  mysqli_stmt_bind_param() expects parameter 1 to be mysqli_stmt, null given in /home/beaskxxb/public_html/index.php on line 11
[15-Jul-2017 05:29:20 America/New_York] PHP Warning:  mysqli_stmt_execute() expects parameter 1 to be mysqli_stmt, null given in /home/beaskxxb/public_html/index.php on line 12
[15-Jul-2017 05:29:20 America/New_York] PHP Warning:  mysqli_stmt_bind_result() expects parameter 1 to be mysqli_stmt, null given in /home/beaskxxb/public_html/index.php on line 13
[15-Jul-2017 05:29:20 America/New_York] PHP Warning:  mysqli_stmt_fetch() expects parameter 1 to be mysqli_stmt, null given in /home/beaskxxb/public_html/index.php on line 14

Someone said I need to make a function.php? I looked in depth into this, because apparently i dont have everything defined, I just really want this to work. Because it seems to be going backward, Im sorry I know it isnt that great. But I just want it to work,

Edit: Table structure of admin:

1   username    longtext    latin1_swedish_ci   Yes NULL    Change Change   Drop Drop 
2   password    longtext    latin1_swedish_ci   No  None    Change Change Drop Drop

Thanks

Answer 1

Firstly - change

$stmt = mysqli_prepare($db,$sql);

to

$stmt = mysqli_prepare($mysqli,$sql);

You were passing the database name and not the connection to the database.

If you do not have a column called id in the table, then you can simply use

$sql = "SELECT password FROM admin WHERE username = ?";

As your just checking the password, that's all you need.

To check that your prepare works OK, change the following lines...

if (!$stmt = mysqli_prepare($mysqli,$sql)) {
    echo "Failed to prepare:".mysqli_error($mysqli);
    return;
}

Edit: After removing the id from the select, you need to change the bind to...

mysqli_stmt_bind_result($stmt, $user_password);