Haha, now you're getting a little complicated.
login.php Create the login page PHP Code:
<?php
require_once ('mysql.php'); // connect to database
session_start ();
if ($_SESSION['loggedin'] != true) {
if (isset ($_POST['submit'])) { // check if form has been sent
// now get the form values
$username = $_POST['username'];
$password = $_POST['password'];
// see if they match a database record
$sql = mysql_query ("SELECT * FROM users WHERE username='".$username."' AND password='".$password."' LIMIT 1");
if (mysql_num_rows ($sql) > 0) {
// a record is found, so set some sessions to log them in
$_SESSION['username'] = $username;
$_SESSION['loggedin'] = true;
} else {
echo 'Username/Password not found, please try again!';
}
} else { // the form was not sent, so display it
echo '<form action="login.php" method="post">
Username <input type="text" name="username" /><br />
Password <input type="text" name="password" /><br />
<input type="submit" name="submit" value="Submit" />
</form>';
}
} else {
echo 'You are already logged in!';
}
?>
logout.php Create the logout page PHP Code:
<?php
session_start ();
unset ($_SESSION);
session_destroy ();
?>
Any page that shall require login, use a if else statement like this:
if ($_SESSION['loggedin'] == true) {
// they're logged in, so they can see this page
} else {
// they're NOT logged in, they CAN'T see this page
}
This is an extremely basic login script, and not secure whatsoever. You should use MD5 or SHA1 with a salt to encrypt the password, and use mysql_escape_string () to escape potentially malicious users from hacking your website.