title: making a page accessible only after login
body: <p>here is the login for login.php:</p>
  
  <pre><code>&lt;?php
       session_start();
       $username = $_POST['username'];
       $password = $_POST['password'];  
       include 'includes/connect.php';
  
       $username = mysqli_real_escape_string( $con, $username );
       $query = "SELECT password, salt FROM member WHERE username = '$username';";
  
       $result = mysqli_query( $con, $query );
  
      if ( mysqli_num_rows( $result ) == 0 ) { // User not found. So, redirect to login_form again.
         header('Location: login.html');
      }
  
      $userData = mysqli_fetch_array($result, MYSQL_ASSOC);
      $hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
  
      if ( $hash != $userData['password'] ) {
         header('Location: login.html');
      } else { // Redirect to home page after successful login.
         $_SESSION['username'] = $userData['username'];
         header('Location: stats.php');
      }
  ?&gt;
  </code></pre>
  
  <p>and here is the  script for stats.php</p>
  
  <pre><code>&lt;?php 
     session_start();
     if ( !isset( $_SESSION['username'] ) ) {
         header("Location:register.html");
     }
  ?&gt;
  </code></pre>
  
  <p>I'm trying to make this page only accessible if your logged in however anyone can access stats.php. </p>