PHP - Login In Sessions

Checking to see if I am going in the right direction, any suggestions would be appreciated!

I am setting up SESSIONs for login and setting a time limit on them.

I have basically 2 scenarios that I need to code for.

1. Registerd user w/good billing has all access
2. Registerd user w/expired billing & Guest user can only go to certain pages and have limited access

This is my login page, will validate the login info and either sends user to one page or another or gives error that the login is incorrect

<?php

// http://www.daniweb.com/forums/thread124500.html

  session_start(); // starting session

  if( isset($_POST['submitLogin'])) {

    include('library/login.php');
    login();
    mysql_select_db('test');

    // username and pswd from login
    $userID=$_POST["userID"];
    $pswd=$_POST["pswd"];

    // to protect from MySQL injection
    $userID = stripslashes($userID);
    $pswd = stripslashes($pswd);
    $userID = mysql_real_escape_string($userID);
    $pswd = mysql_real_escape_string($pswd);

    $sql="SELECT * FROM user WHERE userID='$userID' and pswd='$pswd'";
    $result=mysql_query($sql);

    while ($r=mysql_fetch_array($result)) {
      $exp_date=$r["exp_date"];
      $todays_date=date("Y-m-d");
    }

    // Mysql_num_row is counting table row
    $count=mysql_num_rows($result);

    // If result matched $userID and $pswd, table row must be 1 row
if($count == 1) {
      session_register("userID");
      session_register("pswd");

      $_SESSION['userID'] = $userID;
      
      // verifies billing
      if ($exp_date >= $todays_date) {
        // billing is up to date
        echo "<meta http-equiv='refresh' content='0;url=session2.php'>";
      }
      else  {
        // billing has expired
        echo "<meta http-equiv='refresh' content='0;url=expBilling.php'>";
      }
    }
    else  {
      // login form for when there us an incorrect user/password
      echo " <div id='incorrect'>Please verify the username or password.</div>
      <form method='post' action='' name='login' id='login'>
        <div id='loginForm'>
          <fieldset>
            <span class='textbox'>
              <label for='username'>Username: </label> <input type='text' name='userID' size='25' class='cells' value='$userID'>
              <br><label for='pswd'>Password: </label> <input type='password' name='pswd' size='25'class='cells' value='$pswd'>
              <br><label for='pswd'>&nbsp;</label>Remember Me:  <input type='checkbox' name='Remember' value='21'>
              <br><label for='blank'>&nbsp;</label><a href='resetPswd.php'>Forget Your Password? </a>
              <br><label for='blank'>&nbsp;</label><input type='image' value='Login'  src='img/button_login.gif' width='64' height='25'
                  onmouseover=\"javascript:this.src='img/button_login2.gif';\" onmouseout=\"javascript:this.src='img/button_login.gif';\">
              <input type='hidden' name='submitLogin' value='true'>
            </span>
          </fieldset>
        </div>
      </form>
      ";
    }
  }
  else  {
    // log in form
    echo "
      <form method='post' action=''  name='login' id='login'>
        <div id='loginForm'>
          <fieldset>
            <span class='textbox'>
              <label for='username'>Username: </label> <input type='text' name='userID' size='25' class='cells'>
              <br><label for='pswd'>Password: </label> <input type='password' name='pswd' size='25'class='cells'>
              <br><label for='pswd'>&nbsp;</label>Remember Me:  <input type='checkbox' name='Remember' value='21'>
              <br><label for='blank'>&nbsp;</label><a href='resetPswd.php'>Forget Your Password?</a>

              <br><label for='blank'>&nbsp;</label><input type='image' value='Login' src='img/button_login.gif' width='65' height='25'
              onmouseover=\"javascript:this.src='img/button_login2.gif';\" onmouseout=\"javascript:this.src='img/button_login.gif';\">
              <input type='hidden' name='submitLogin' value='true'>
            </span>
          </fieldset>
        </div>
      </form>
      ";
  }
  
?>

If the billing is good then user will go here

<?PHP
  session_start();

  // session timing
// set timeout period in seconds
$inactive = 15;

// check to see if $_SESSION['timeout'] is set
if(isset($_SESSION['timeout']) ) {
  $session_life = time() - $_SESSION['timeout'];
    if($session_life > $inactive)  {
      session_destroy(); }
}

$_SESSION['timeout'] = time();

// END session timing



  if(!session_is_registered(userID)){
    header("location:login.php");
  }
?>

<html>
<body>
  Login Successful
</body>
</html>

If the billing has expired user goes here

<?php
  session_start();

  // session timing
// set timeout period in seconds
$inactive = 15;

// check to see if $_SESSION['timeout'] is set
if(isset($_SESSION['timeout']) ) {
  $session_life = time() - $_SESSION['timeout'];
    if($session_life > $inactive)  {
      session_destroy(); }
}

$_SESSION['timeout'] = time();

// END session timing


  // if the user has been timed out or not logged in
  if(!session_is_registered(userID)){
    header("location:form.php");
  }

  // user is logged in and their billing is good
  else {
    echo "Warning! <b>";
    echo $_SESSION['userID'];
    echo "</b> Your billing has expired ";
  } // end session

?>

I also created this page to test what happens when a non-subscriber trys to go to a page without logging in, it also
test the billing and blocks a user whose billing is expired.

<?php
session_start();

// session timing
// set timeout period in seconds
$inactive = 15;

// check to see if $_SESSION['timeout'] is set
if(isset($_SESSION['timeout']) ) {
  $session_life = time() - $_SESSION['timeout'];
    if($session_life > $inactive)  {
      session_destroy(); }
}

$_SESSION['timeout'] = time();

// END session timing

  // if the user has been timed out or not logged in
  if(session_is_registered(userID)){

    // verify billing if user comes in directly thru this page

    include('library/login.php');
    login();
    mysql_select_db('test');

    $userID = $_SESSION['userID'];

    $sql="SELECT * FROM user WHERE userID='$userID'";
    $result=mysql_query($sql);

    while ($r=mysql_fetch_array($result)) {
      $exp_date=$r["exp_date"];
      $todays_date=date("Y-m-d");
    }

    // Mysql_num_row is counting table row
    $count=mysql_num_rows($result);

    // If result matched $userID and $pswd, table row must be 1 row
if($count == 1) {
      // checks dates
      if ($exp_date >= $todays_date) {
        // billing is up to date
            echo "Welcome: ";
            echo $_SESSION['userID'];
      }
      else  {
        // billing has expired
        echo "<meta http-equiv='refresh' content='0;url=expBilling.php'>";
      }
    }
    // END verify billing
  }
  // user is logged in and their billing is good
  else {
    echo "Welcome: ";
    echo "Non-user can view this stuff.";
    echo "<br><a href='form.php'>Click here to register</a>";
  } // end session
?> 


These are all test pages once I get the coding right I will incorporate it into the real pages.