The short answer is, use bcrypt, not SHA256. Bcrypt already hashes the password, so if you are using bcrypt, there is no point to use both bcrypt+SHA256; it won't be any stronger. Bcrypt alone is sufficient.
There's a lot of advice on this site on exactly this topic. Search for "password hashing" and you'll find it.
See, e.g., How to securely hash passwords?, Which password hashing method should I use?, Most secure password hash algorithm(s)?, Do any security experts recommend bcrypt for password storage?.
You want to use a password hashing algorithm that is as slow as you can stand, to prevent offline dictionary attacks on people's passwords if your database is compromised.
Of course, that is not enough. There are a variety of steps you should take to make use of passwords as secure as possible. Here are a few:
Use site-wide SSL/TLS. Any attempt to visit your site through HTTP should immediately redirect to HTTPS.
Enable HSTS on your site. This tells browsers to only connect to you via HTTPS. Paypal uses it. It is supported in recent versions of Firefox and Chrome.
Search the site and you'll find lots more.