Frank_b

$users = array( 'Dexter'=>'meow1', 'Garfield'=>'meow2', 'Miro'=>'meow3' ); if(isset($users[$_POST['username']]) && $users[$_POST['username']] == $_POST['password']) { // login succesfull $_SESSION['username'] = $_POST['username']; header('Location: secured_area.php'); exit; }

After a correct login you can redirect your users to any page you like: <?php header('Location: index.php'); exit; ?>

header('location:student_home.php'); should be: header('Location: student_home.php');

What are you doing on rule 26? You compare if the username equals to the password. Instead you should test if the given username exists in your users array. if it does you should test if the password is correct with the password in the same element you have found in the array. Why do you post your loginform to another page? You should keep your users on the loginpage as long the login is not correct. After a correct login you should redirect your users to the secured area of the site.