php login behaving strangely

Question

The login works as a typical login should, the problem is that you can ONLY put in the username and it will log you in. Pretty much if the username is correct then the password doesnt even matter.

php

<?php
include 'password.php'; 

session_start();
if (!isset($_SESSION['loggedIn'])) {
    $_SESSION['loggedIn'] = false;
}

if (isset($_POST['password']) && isset($_POST['user'])) {
    if (sha1($_POST['password'] == $password) && sha1($_POST['user']) == $user) {
        $_SESSION['loggedIn'] = true;
    } else {
        $error_msg = "Incorrect Login!";
    }
} 

if (!$_SESSION['loggedIn']): ?>

Answer 1

the mistake is at this line

    if (sha1($_POST['password'] == $password) && sha1($_POST['user']) == $user) {

you put the parentheses to the wrong place (the one after password), the following should be fine.

    if (sha1($_POST['password']) == $password && sha1($_POST['user']) == $user) {

Answer 2

Besides the fact what marvin explained, I would add a line into your code.

} else {
        $error_msg = "Incorrect Login!";
        $_SESSION['loggedIn'] = false;   // Add this line
}