The only thing you are checking for is whether the password entered is null.

If not, then it goes right through.

You need to be checking if what is being entered = 'proper password'