PHP - Error In My Login Session

Im trying to make sessions work with my script, its finding the user/pass in the database and redirects me to the homepage after but the parts that are supposed to show when the session is set are not showing.

My code:


<?php
// Login Logic

$username = "";
$err = "";
$err_style = "";
$err_style2= "";

//Checks if there is a login cookie
if(isset($_SESSION['username'])) { 

    //if there is, it logs you in and directes you to the members page
    $_SESSION['username'] = $username;
    $_SESSION['password'] = $password;
    //$username = $_COOKIE['user_id']; 
    //$pass = $_COOKIE['pass_id'];
    $check = mysql_query("SELECT * FROM users WHERE username = '$username'")or die(mysql_error());$quer++;
    while($info = mysql_fetch_array( $check )) {
        if ($pass != $info['password']) {
        
        }
        else {
            header("Location: index.php");
        }
    }
}

//if the login form is submitted
if (isset($_POST['submit'])) { // if form has been submitted

    // SANITISE
    
    $username     = sanitize($_POST['username']);
    $pass        = sanitize($_POST['password']);
    $red        = sanitize($_POST['red']);
    
        // makes sure they filled it in
    if(!$_POST['username']) {
        $err = 'You did not fill in a required section';
        $err_style = "style='border: 1px solid #CC0000'";
        $show_login = 1;
    }
        if(!$_POST['password']) {
        $err = 'You did not fill in a required section';
        $err_style2 = "style='border: 1px solid #CC0000'";
        $show_login = 1;
    }
    // checks it against the database
    
    if (!$err) {
    $check = mysql_query("SELECT * FROM users WHERE username = '".$username."'")or die(mysql_error());$quer++;

    //Gives error if user dosen't exist
    $check2 = mysql_num_rows($check);
    
    if ($check2 == 0) {
        $err = 'User not found - please try again!';
        $err_style = "style='border: 1px solid #CC0000'";
        $show_login = 1;
    }
    
    while($info = mysql_fetch_array( $check )) {
        $info['password'] = stripslashes($info['password']);
        $pass = $pass;

        //gives error if the password is wrong
        if ($pass != $info['password']) {
            $err = 'Incorrect password, please try again.';
            $err_style2= "style='border: 1px solid #B02B2C;'";
            $show_login = 1;
        }
        else { 
        
        session_start();
        $_SESSION['username'] = $username;
        $_SESSION['password'] = $password;    
        
        // if login is ok then we add a cookie 
        //$hour = time() + 3600; 
        //setcookie("user_id", $username, $hour); 
        //setcookie("pass_id", $pass, $hour);    

        //then redirect them to the members area 
        
        if (!$red) {
            header("Location: index.php"); 
        } else {
            header("Location: $red.php"); 
        }
        exit;
        } 
    } 
    
    }
} 

?>


And:


<?php 
session_start();

//checks cookies to make sure they are logged in 
if(isset($_SESSION['username'])) {
     $_SESSION['username'] = $username;
    $_SESSION['password'] = $password;
    //$username = $_COOKIE['user_id']; 
    //$pass = $_COOKIE['pass_id']; 
    $check = mysql_query("SELECT * FROM users WHERE username = '$username'")or die(mysql_error()); $quer++;
    
    while($info = mysql_fetch_array( $check )) { 
        //if the cookie has the wrong password, they are taken to the login page 
        if ($pass != $info['password']) { 
            header("Location: login.php"); 
        } 

        //otherwise they are shown the admin area    
        else { 
        // Update some info
    
        session_start();
        $_SESSION['username'] = $username;
        $_SESSION['password'] = $password;    
    
    
        //setcookie ("user_id", $_COOKIE['user_id'], time() + 3600 );
        //setcookie ("pass_id", $_COOKIE['pass_id'], time() + 3600 );

        // Get some basic user details, so we can use these later!
        $uname  = $info['username'];
        $uID        = $info['user_id'];
        $email    = $info['email'];
        $loggedin = 1;
        $admin_user    = $info['admin'];
        } 
    } 
}
 
?>

OK when i go to my website and login i stay login in intill i sign out but when im stilled loged in and click new tab and type my website i see the login table but im already loged in so i have to click on my logo to time to make the login table go away why if you need the login code i would be happy to give it to use

This should be really simple, but I just can't figure out why it isn't working. It's my first time using sessions, so I'm probably doing something silly. It's just a login to an admin page. It's for a photo gallery, that's why the database is called "photo".

This is the login page:
Code: [Select]
<?php
session_start();

if(isset($_POST['user']) && isset($_POST['password'])){
$user = $_POST['user'];
$password = sha1($_POST['password']);

$photo = new mysqli('localhost', 'user', 'password', 'photo');
$login = $photo->query("select user, sha1(password) from settings where user = '$user' and sha1(password) = '$password'");

if($login->num_rows > 0){
$_SESSION['login'] = 1;
?>
<META HTTP-EQUIV="Refresh" Content="0; URL=admin.php">
<?php
} else {
$badlogin = 1;
}
}
?>

<html>
<head>

<style>
body {margin-top: 50px;}
td {text-align: right;}
input {width: 200px;}
</style>

</head>
<body><center>

<?php
if(isset($badlogin)){
?>
<span style="color: red;">Oops! Wrong login.</span><br><br>
<?php
}
?>

<table>
<form action="admin.php" method="post">
<tr><td>User:</td><td><input type="text" name="user" /></td></tr>
<tr><td>Password:</td><td><input type="password" name="password" /></td></tr>
<tr><td></td><td><input type="submit" value="Login" /></td></tr>
</form>
</table>

</center></body>
</html>
And this is the admin page:
Code: [Select]
<?php
session_start();
if($_SESSION['login'] != 1){
?>
<META HTTP-EQUIV="Refresh" Content="0; URL=login.php">
<?php
} else {
?>

<html>
<head>



</head>
<body>

Admin stuff here.

</body>
</html>

<?php
}
?>

Hi guys, I have a loggin page which works fine except it doesnt pass the session, could someone help me to see what mistake im making?
once users login they will be diverted to another page where is their profile page, i have echoed the session in member page but it doesnt read it.

i have attached both codes (member page and login page) below, thanks in advance for your help


code is below:
login page code:


Code: [Select]
<?php

//connect to database 
include '../include/db.php';

//we start a session here to help us pass the user login variable to other pages of the webs application while user is logged in.
session_start();

//php login

// if post has been successfully sent, do the action below

if ($_POST['login']){

// get data from form fields
$email=strip_tags($_POST['email']);
$password=strip_tags($_POST['password']);


// check if email (username) and password have been inserted, if not show an error

if($email == "" || $password == "")
echo "Please enter your email address and postcode";
else 
{

//check if email exists

$checkemail=mysql_query("SELECT * FROM member WHERE EmailAddress='$email'");


//if exists we get the information from database
if 

($getrows=mysql_num_rows($checkemail)>=1){

while ($row=mysql_fetch_array($checkemail))
{
$myemail=$row['EmailAddress'];
$mypassword=$row['Password'];
}

//convert the password to md5

$pass=md5($password);



//now we check if entered email and password match our database record
if ($myemail==$email && $mypassword==$pass)

{

$_SESSION['emailaddress']=$myemail;

//update the loggedin to 1 so we users go to next page, our website will compare if users is logged in or not
$update=mysql_query("UPDATE member SET loggedin='1' WHERE EmailAddress='$email'");

//if details exist we get the users first name  our database to pass this information along with our sessions
$getuser=mysql_query ("SELECT * FROM member WHERE EmailAddress='$email'");
while($row=mysql_fetch_array($getuser))

{
$firstname=$row['FirstName'];


}
echo "Welcome $firstname, <a href='profile.php'>Click here</a> to be directed to your profile";
}

}
else 

{
echo "This user doesn't exists";
}

}
}



?>




and this is the member page so far

Code: [Select]
<?php
//connect to database 
include '../include/db.php';

//we start a session here to help us pass the user login variable to other pages of the webs application while user is logged in.
session_start();
echo "Welcome ".$_SESSION['emailaddress']."";
?>

<!DOCTYPE html>
<html>
<head>
	<style type="text/css" media="screen">
		.ss
		{
			border-width: 1px;
			border-style:solid;
			width: 100px;
			height: 100px;

	</style>
	<meta charset="utf-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<title></title>
	<link rel="stylesheet" href="">
</head>
<body>
	<form action="index.php" method="post">

	<table align="center" class="ss">
		<tr>
			<td>Name<input type="text" name="name">
</td>
		</tr>
		
		<tr>
			<td>Pass&nbsp:<input type="password" name="pass">

</td>
		</tr>
		<tr>
			<td>Email<input type="text" name="eml">
</td>
<tr>
			<td><input type="submit" name="sb">
</td>
	</table>
	
		

	</form>
	
</body>
</html>
<?php 
include "db.php";
session_start();
if(isset($_POST['sb']))
{
	
	$name=mysqli_real_escape_string($con, $_POST['eml']);
	$pass=mysqli_real_escape_string($con, $_POST['pass']);
	$usr=mysqli_real_escape_string($con,'user');
    
	$std='std';
	$type='admin';
	$qer="select * from users where eml='$name' AND pass='$pass' AND type='$type'";
	$sql=mysqli_query($con,$qer);

	$qer=" select * from users where eml='$name' AND pass='$pass' AND type='$std'";
	$sql1=mysqli_query($con,$qer);

	$qer=" select * from users where eml='$name' AND pass='$pass' AND type='$usr'";
	$sql3=mysqli_query($con,$qer);


	$fe=mysqli_fetch_array($sql);
	if(is_array($fe)) {
		$name=$name;
		$pass=$pass;

        {

	
	header("location:wel.php?msg=Scuessfull login");

	
}
echo "Admin of this site";

}

else if($fe=mysqli_fetch_array($sql1)){

	if(is_array($fe)) 
	
		$name=$name;
		$pass=$pass;
echo "Moderator of the site";
{ 
	
	
	header("location:mod.php?msg=Scuessfull login");

	
}

}

else if($fe=mysqli_fetch_array($sql3)){

	if(is_array($fe)) 
		$name=$name;
		$pass=$pass;
			$_SESSION['eml'] =true;
			header("location:sim.php?msg=Scuessfull login");
echo "Simple user this site";
}



else
{
	echo "invalid pass";
   }
       }
?>