Issue on Welcome to logged in User
<p>I am trying to add a welcome to user in a restricted area using PHP login system. I used this code to transfer usernale from first user login page to restricted page but it didnt work</p>

<pre><code>if ( (isset($_POST['username'])) || (isset($_POST['password'])) { 
                   $user = $_SESSION['username'];
      } 
</code></pre>

<p>Here are the files that I am using, Can you please take a look at them and let me know what I am doing wrong?</p>

<pre><code>&lt;form id="login-form" method="post" action="includes/login.inc.php"&gt; 
&lt;fieldset&gt; 
  &lt;legend&gt;Login to Web Site&lt;/legend&gt; 
   &lt;label for="username"&gt; 
    &lt;input type="text" name="username" id="username" /&gt;Username: 
  &lt;/label&gt; 
  &lt;label for="password"&gt; 
    &lt;input type="password" name="password" id="password" /&gt;Password: 
  &lt;/label&gt; 
  &lt;label for="submit"&gt; 
    &lt;input type="submit" name="submit" id="submit" value="Login" /&gt; 
  &lt;/label&gt; 
&lt;/fieldset&gt; 
</code></pre>

<p> </p>

<p>I have a php login file which is like this:</p>

<pre><code>&lt;?php 
 require_once('config.inc.php'); 
 require_once('functions.inc.php'); 

 // Start session 
 session_start(); 

 // Check if user is already logged in 
 if ($_SESSION['logged_in'] == true) { 
          // If user is already logged in, redirect to main page 
          redirect('../index.php'); 
  } else { 
          // Make sure that user submitted a username/password and username only consists of alphanumeric chars 
          if ( (!isset($_POST['username'])) || (!isset($_POST['password'])) OR 
               (!ctype_alnum($_POST['username'])) ) { 
                        redirect('../login.php'); 
          } 

          // Connect to database 
          $mysqli = @new mysqli(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE); 

          // Check connection 
          if (mysqli_connect_errno()) { 
                        printf("Unable to connect to database: %s", mysqli_connect_error()); 
                        exit(); 
          } 

          // Escape any unsafe characters before querying database 
          $username = $mysqli-&gt;real_escape_string($_POST['username']); 
          $password = $mysqli-&gt;real_escape_string($_POST['password']); 

          // Construct SQL statement for query &amp; execute 
          $sql              = "SELECT * FROM users WHERE username = '" . $username . "' AND password = '" . md5($password) . "'"; 
          $result = $mysqli-&gt;query($sql); 

          // If one row is returned, username and password are valid 
          if (is_object($result) &amp;&amp; $result-&gt;num_rows == 1) { 
                        // Set session variable for login status to true 
                        $_SESSION['logged_in'] = true; 
                        redirect('../index.php'); 
          } else { 
                        // If number of rows returned is not one, redirect back to login screen 
                        redirect('../login.php'); 
          } 
 } 
 ?&gt; 
</code></pre>

<p>and on my restricted page I have:</p>

<pre><code>&lt;?php 
 // Start session 
 session_start(); 
 if ( (isset($_POST['username'])) || (isset($_POST['password'])) { 
                       $user = $_SESSION['username'];
          } 
  require_once('includes/functions.inc.php'); 
 if (check_login_status() == false) { 
          redirect('login.php'); 
  } 
 ?&gt; 
 &lt;!DOCTYPE html&gt; 
&lt;html&gt; 
&lt;body&gt;
&lt;div id="page"&gt;

  &lt;a class="welcome"&gt;
    Welcome:  &lt;?php echo $user; ?&gt;
  &lt;/a&gt;
 &lt;/div&gt;
</code></pre>
