title: How to set and check a session after login?
body: <p>I'm new to PHP and struggling with a login page.  I have the following script that "works" but now I'd like to set a session if the user's password is correct that I can carry over to other pages.  So I'm trying to figure out what needs to be on those other pages to check for the session.</p>
  
  <p>From this, if I put something like this on the page I'm coming back to:</p>
  
  <pre><code>&lt;?php
  if($_SESSION['login'] = "1") {  
  echo "you are logged in";
  }
  else
  {
  echo "you are not logged in";
  }
  ?&gt;
  </code></pre>
  
  <p>It seems like I get my success message all the time.  I must not be understanding how this works.  Any suggestions appreciated--am up for totally rewriting this if I need to.  Thanks!</p>
  
  <p>Here's my current login script:</p>
  
  <pre><code>&lt;?php
  // error reporting
  ini_set('display_errors',1); 
   error_reporting(E_ALL);
  $host="foo"; // Host name
  $username="foo"; // Mysql username
  $password="foo"; // Mysql password
  $db_name="foo"; // Database name
  $tbl_name="members"; // Table name
  // Connect to server and select databse.
  mysql_connect("$host", "$username", "$password")or die("cannot connect");
  mysql_select_db("$db_name")or die("cannot select DB");
  // username and password sent from form
  $myusername=$_POST['myusername'];
  $mypassword=$_POST['mypassword'];
  // To protect MySQL injection (more detail about MySQL injection)
  $myusername = stripslashes($myusername);
  $mypassword = stripslashes($mypassword);
  $myusername = mysql_real_escape_string($myusername);
  $mypassword = mysql_real_escape_string($mypassword);
  $sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
  $result=mysql_query($sql);
  // Mysql_num_row is counting table row
  $count=mysql_num_rows($result);
  // If result matched $myusername and $mypassword, table row must be 1 row
  if($count==1) {
  session_start();
  $_SESSION['login'] = "1";
  header ("Location: http://www.google.com");
  }
  else {  
  session_start();
  $_SESSION['login'] = '';
  header ("Location: http://www.yahoo.com");
  }
  ?&gt;
  </code></pre>
  
  <p>Applying changes suggested below, I have the following in the page I'm coming back to:</p>
  
  <pre><code>&lt;?php
  session_start();
  if ($_SESSION['login'] == "1") {  
  echo "you are logged in";
  }
  else if ($_SESSION['login'] == "") 
  {
  echo "you are not logged in";
  }
  ?&gt;
  </code></pre>
  
  <p>and the following change to my login script:</p>
  
  <pre><code>if($count==1) {
  session_start();
  $_SESSION['login'] =="1";
  header ("Location: login.php");
  }
  else {  
  session_start();
  $_SESSION['login'] == "";
  header ("Location: login.php");
  }
  </code></pre>
  
  <p>Now no matter what, I'm getting my "you are not signed in" message...hmm. </p>
  
  <p>Update--OK--if I DON'T make the == change to my script it seems to work.  If I have</p>
  
  <pre><code>if($count==1) {
  session_start();
  $_SESSION['login'] = "1";
  header ("Location: login.php");
  }
  else {  
  session_start();
  $_SESSION['login'] = "";
  header ("Location: login.php");
  } 
  </code></pre>
  
  <p>and this in the page I come back to:</p>
  
  <pre><code>&lt;?php
  session_start();
  if ($_SESSION['login'] == "1") {  
  echo "you are logged in";
  }
  else if ($_SESSION['login'] == "") 
  {
  echo "you are not logged in";
  ?&gt;
  </code></pre>
  
  <p>...that seems to work.</p>