PHP Login Script

Hi,
I have a table in my index.php page in which i have the login form, once the users enters their login credential, it takes them to login.php page & here i do my database query. Now if it is a succesfully query i.e the login credentials are correct it should take the user back to the index.php page but the table that previous had the login form should not be there but instead a welcome message.
This is my index.php code:

<?
if (!isset($_SESSION['username'])){
echo "<form id='form1' name='form1' method='post' action='login.php'>";
echo "<table width='100%' border='1'>";
echo "<tr>";
echo "<td bgcolor='#000000'><div align='center' class='WDWD'><strong>MEMBER LOGIN</strong></div></td>";
echo "</tr>";
echo "<tr>";
echo "<td>USER";
echo "<label>";
echo "<input type='text' name='user' id='user' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td>PASS";
echo "<label>";
echo "<input type='text' name='pass' id='pass' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td><label>";
echo "<input type='submit' name='button' id='button' value='Submit' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td>IF NOT A MEMBER, CLICK HERE TO REGISTER</td>";
echo "</tr>";
echo "</table>";
echo "</form></td>";
}
else{
echo "Welcome message";
}
?>


And this is my login.php page:

<?
$host="localhost"; // Host name
$username="*****"; // Mysql username
$password="*****"; // Mysql password
$db_name="*****"; // Database name
$tbl_name="*****"; // Table name
$user=$_POST['user'];
$pass=$_POST['pass'];

// Connect to server and select databse.
$con= mysql_connect("$host", "$username", "$password");
if (!$con){
die("cannot connect");
}
mysql_select_db($db_name, $con);
$sql="SELECT * FROM $tbl_name WHERE user_name='$user' and pass='$pass'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if ($count==1){
session_start();
$_SESSION['username'] = $user;
header("location:index_beta.php?");
//If login is successfull then users should be directed to the login page but the table which previously has the login form should now contain the welcome message
}
else{
//if login is not successfull, it should again take users back to the index.php page but the table with login form should be there :)
}

?>

Thank you for your support :)

Wrap your login box in a conditional test for some token signifying the user is logged in. Looks like $_SESSION['username'] might work. So, something like this:

<div id="userbox">
<?php
// logged in?
if (isset($_SESSION['username']))
{
echo $welcome_message;
}
else
{
echo $login_box;
}
?>
</div>

i tried this:

<?
if (isset($_SESSION['username'])){
echo "Welcome message";
}
else{
echo "<form id='form1' name='form1' method='post' action='login.php'>";
echo "<table width='100%' border='1'>";
echo "<tr>";
echo "<td bgcolor='#000000'><div align='center' class='WDWD'><strong>MEMBER LOGIN</strong></div></td>";
echo "</tr>";
echo "<tr>";
echo "<td>USER";
echo "<label>";
echo "<input type='text' name='user' id='user' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td>PASS";
echo "<label>";
echo "<input type='text' name='pass' id='pass' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td><label>";
echo "<input type='submit' name='button' id='button' value='Submit' />";
echo "</label></td>";
echo "</tr>";
echo "<tr>";
echo "<td>IF NOT A MEMBER, CLICK HERE TO REGISTER</td>";
echo "</tr>";
echo "</table>";
echo "</form></td>";
}
?>

but when page is refreshed it still showz the login form even when session value is submitted.
It seems it doesnt take the session value, i start my session on my login.php page and give it a value from the user text field, below is my login.php file:

session_start();
$_SESSION['username'] = $user;
header("location:index.php?");

am able to do this with cookies, is it safe to have cookies instead of session?

You need session_start on index.php, too. Wherever you use $_SESSION, you need session_start at the top.

Yes, you can use a normal cookie, but sessions are fun! :) They're actually quite useful once you figure out how to use them. Try adding the session_start function to index.php and see what happens.

Thanks :) it works now, but am getting some funny errors before the display:
Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/buysell5/public_html/index_beta.php:6) in /home/buysell5/public_html/index_beta.php on line 32

When you get errors like that ("Cannot send session cookie - headers already sent"), paste them into Google. Lots of answers. "Headers already sent" errors mean that you're trying to send header info when you've already sent output to the browser. If you'll show index_beta.php (it says the output started on line 6), someone should be able to tell you what's going on.