Q:

php bind parameters in mysqli login not working

Can anyone tell me where I am going wrong with this? Every time it returns with 'login failed' and won't let me pass to the next screen. I'm starting to tare my hair out!!
if(!empty($_POST)) { 
        $query = "SELECT id, username, password, salt FROM User WHERE username = ?";
        $sql = $db->prepare($query); 
        $sql->bind_param('s', $user);
        $user = $_POST['username'];
        $sql->execute();

        if(!$row = $sql->affected_rows) {   
           print('There was an error running the query [' . $db->error . ']' . gettype($user)); 
        } 

        $login_ok = false; 

        if($row) { 
            $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
            for($round = 0; $round < 65536; $round++) { 
                $check_password = hash('sha256', $check_password . $row['salt']); 
            } 
            if($check_password === $row['password']) { 
                $login_ok = true; 
            } 
        } 

        if($login_ok) { 
            unset($row['salt']); 
            unset($row['password']); 
            $_SESSION['user'] = $row; 
            header("Location: home.php"); 
            die("Redirecting to: home.php"); 
        } else { 
            $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
            print("Login Failed. " . $submitted_username);
        } 
    } 

Update after Comments and Barmars answer
    include '../private/conn.php';
    $submitted_username = ''; 

    if(!empty($_POST)) { 
        $query = "SELECT id, username, password, salt FROM User WHERE username = ?";
        $sql = $db->prepare($query); 
        $sql->bind_param('s', $user);
        $user = $_POST['username'];
        $sql->execute();

        $login_ok = false;
        $sql->bind_result($id, $username, $password, $salt);

        if ($sql->fetch()) {
            $check_password = hash('sha256', $_POST['password'] . $salt); 
            for($round = 0; $round < 65536; $round++) { 
                $check_password = hash('sha256', $check_password . $salt); 
            } 
            if($check_password === $password) { 
                $login_ok = true; 
            } 
        }

        if($login_ok) { 
            unset($row['salt']); 
            unset($row['password']); 
            $_SESSION['user'] = $row; 
            header("Location: home.php"); 
            die("Redirecting to: home.php"); 
        } else { 
            $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
            print("Login Failed. " . $submitted_username);
        } 
    } 

A:

You're never calling $sql->fetch() to get the row. You're setting $row to $sql->affected_rows, which returns a number, then you're trying to use it as an associative array. If you had warnings enabled, you would have seen notices about this error.
WHen using a prepared statement, you need to use bind_result to get the results into variables, and then call fetch() to fetch a row.
$sql->bind_result($id, $username, $password, $salt);
if ($sql->fetch()) {
    $check_password = hash('sha256', $_POST['password'] . $salt); 
    for($round = 0; $round < 65536; $round++) { 
        $check_password = hash('sha256', $check_password . $salt); 
    } 
    if($check_password === $password) { 
        $login_ok = true; 
    } 
} 

