You would need to modify your code before doing anything else.
Currently, what your script does is it allows a user to login, once a successful login attempt is performed a session is created with array key login and value 1
So now we can see if that user is logged in but we can't find out any information about them? This is because no actual user data is stored in the session, just an understanding that the user successfully logged in.
Some may say, oh well we can just set the value for login to correspond to the users id. You can do this as well. My method is flawed because I'm using your query that checks if the username and password matches the $_POST data to store user information. I won't go into more detail about this unless you specifically ask.
You'll want something like this:
<?phpif ($_SERVER['REQUEST_METHOD'] == 'POST') { $username = mysql_real_escape_string($_POST['username']); $password = mysql_real_escape_string(md5($_POST['password'])); $query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); $query_rows = mysql_num_rows($query); if($query_rows > 0) { $user_data = mysql_fetch_assoc($query); echo ("Succesfull Login!"); session_start(); $_SESSION['user'] = $user_data; } else { echo ("Username and/or password incorrect"); }}if(isset($_SESSION['user'])){ echo "Welcome {$_SESSION['user']['username']}";}
Now, let's understand how to use the new array.
Say you have some extra fields in your users table, like email or location for example and you want to access it. How would you do it with this code? Simple:
echo $_SESSION['user']['email'];
I am a bit sleepy so I'm going to stop here. Sorry for the lack of detail within this last bit, I've grown quite tired of posting this and I'm dozing off. Ask any questions you want and I'll get to them once my mind has straightened up.