title: Securely pass variable data to different php file
body: <p>I'm trying to make a dashboard after my userlogin, however I want it on a different page. But I'm afraid passing data via url might not be necessary caused it can be changed manually. I want to pass <code>$username</code> to my dash.php file. Here's my code:</p>
  
  <p>login.php</p>
  
  <pre><code>&lt;?php
  session_start();
  //Insert Connection String
  require_once 'config.php';
  if(!$_SESSION['username']){
  if (!isset($_POST['submit'])) {
      echo'&lt;form action="login.php?logged=yes" method="post"&gt;';
      echo'&lt;label&gt; Username&lt;/label&gt;';
      echo'&lt;input type="text" name="username"/&gt;';
      echo'&lt;label&gt; Passowrd&lt;/label&gt;';
      echo'&lt;input type="password" name="password"/&gt;';
      echo'&lt;input type="submit" name="submit" value="Login!"/&gt;';
      echo'&lt;/form&gt;';
  } else {
  
  
      //handle some errors
      //If both fields are empty
      if(!$_POST['username'] &amp;&amp; !$_POST['password']) {
          echo"Try to login without entering any info, genius.";
      }
      else {
          //check if the username exists
          if(!empty($_POST['username'])) {
              //check if the password exists
              if(!empty($_POST['password'])) {
                  //Put unencrypted username variable
                 $username = $_POST['username'];
                  //Encrypt the values
                  $xusername = md5($_POST['username']);
                  $xpassword = md5($_POST['password']);
                  //Check if they exist in the database
                  $query = odbc_exec($conn, "SELECT * FROM xmember WHERE    username='$xusername' AND password='$xpassword'");
                  $user_rows = 0;
                  while ($row = odbc_fetch_array($query)) {
                      $user_rows++;
                  }
                  odbc_free_result($query);
                  if($user_rows == 1) {
                      echo 'Welcome, '.$_POST['username'];
                      $_SESSION['username'] = $_POST['username'];
                      echo "&lt;meta http-equiv='refresh' content='3;url=dash.php'&gt;";
  
                  }
                  else {echo"Sorry, your account information is invalid.";}
              }
              else {echo"Please put your password";}
          }
          else {echo"Please put your username";}
  
      }   
  
  
  }
  else {echo"what are you doing here?";}
  ?&gt;
  </code></pre>
  
  <p>config.php</p>
  
  <pre><code>&lt;?php
  /*
  Le Change Nickname PHP v1.0 made by Thor KK Klein LOL
  CONFIG section
  */
  //Set Network Config
  $odbc_dsn = "mydb";
  $odbc_user = "sa";
  $odbc_password = "wh@tTh3!?";
  
  $conn = odbc_connect($odbc_dsn, $odbc_user, $odbc_password);
  if(!$conn) {die('Failed to connect to the database!');}
  
  
  ?&gt;
  </code></pre>
  
  <p>dash.php</p>
  
  <pre><code>&lt;?php
  session_start();
  require_once 'login.php';//load connection settings and get info
  
  if(!$_SESSION['username']){
      echo"Are you kidding me?";
  }else {
      //Display The Dashboard
  
      //Get user's typical information
  
      //Get user's table row array
      echo"Welcome, ".$username;
  }
  ?&gt;
  </code></pre>
  
  <p>I tried require-once'ing login.php to my dash.php to get the data.. but it doesn't seem to work.</p>