title: simple login session php
body: <p>Having trouble getting my session up and running. I've been over looking my code for the past couple hours and I can't see to find what is wrong with it. The problem I am experiencing is that every time I type the username and password in, it just redirects me to the login page to type in the info again when it should be displaying the securedpage.php.. </p>
  
  <p>Here is my code:</p>
  
  <p><strong>loginproc.php page</strong> - This page steps through if statement and goes straight to the else</p>
  
  <pre><code>&lt;?php
  
  // Inialize session
  session_start();
  
  // Include database connection settings
  include('../../model/database.php');
  
  // Retrieve username and password from database according to user's input
  $login = mysql_query("SELECT * FROM user WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . mysql_real_escape_string($_POST['password']) . "')");
  
  // Check username and password match
  if (mysql_num_rows($login) == 1) {
  // Set username session variable
  $_SESSION['username'] = $_POST['username'];
  // Jump to secured page
  header('Location: securedpage.php');
  }
  else {
  // Jump to login page
  header('Location: index.php');
  }
  
  ?&gt;
  </code></pre>
  
  <p><strong>securedpage.php page</strong></p>
  
  <pre><code>&lt;?php
  
  // Inialize session
  session_start();
  
  // Check, if username session is NOT set then this page will jump to login page
  if (!isset($_SESSION['username'])) {
  header('Location: index.php');
  }
  
  ?&gt;
  &lt;html&gt;
  
  &lt;head&gt;
  &lt;title&gt;Secured Page&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
  
  &lt;p&gt;This is secured page with session: &lt;b&gt;&lt;?php echo $_SESSION['username']; ?&gt;&lt;/b&gt;
  &lt;br&gt;You can put your restricted information here.&lt;/p&gt;
  &lt;p&gt;&lt;a href="logout.php"&gt;Logout&lt;/a&gt;&lt;/p&gt;
  
  &lt;/body&gt;
  
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>database.php page</strong></p>
  
  <pre><code>&lt;?php
  $dsn = 'mysql:host=localhost;dbname=sports_db';
  $username = '';
  $password = '';
  $options = array(PDO::ATTR_ERRMODE =&gt; PDO::ERRMODE_EXCEPTION);
  
  try {
      $db = new PDO($dsn, $username, $password, $options);
  } catch (PDOException $e) {
      $error_message = $e-&gt;getMessage();
      include 'errors/db_error_connect.php';
      exit;
  }
  
  function display_db_error($error_message) {
      global $app_path;
      include 'errors/db_error.php';
      exit;
  }
  ?&gt;
  </code></pre>