set session when user logs? - php

Question

i am using a login script that is suppose to set a session when a user logs in. this session is called '$_SESSION['user']' and is a unique number stored in my table under 'session_number'.
$_SESSION['user'] = 'session_number'
Login Script (login.php):
<?php
include("config.php");
$tbl_name="supplier_pre_sign";
$myusername=$_POST['myusername'];
$myusername = stripslashes($myusername);
$myusername = mysql_real_escape_string($myusername);
$sql="SELECT * FROM $tbl_name WHERE code='$myusername' and status='active'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
$row=mysql_fetch_array($result);
if($count==1){
session_start();
$_SESSION['user']=$myusername;
$_SESSION['username']=$row['firstname'];
if(isset($_SESSION['val']))
$_SESSION['val']=$_SESSION['val']+1;
else
$_SESSION['val']=1;
$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
$query = "SELECT * FROM supplier_session WHERE user_IP='$ip'";
$result = mysql_query($query);
if (mysql_num_rows($result) > 0) {
}else{
$myusername = filter_input(INPUT_POST, 'myusername');
$ipaddress = $_SERVER["REMOTE_ADDR"];
$sql="INSERT INTO supplier_session (session_number, user_IP, date)
VALUES ('$myusername', '$ipaddress', NOW())";
$result = mysql_query($sql);
}
header("location:supplier_panel.php");
}else {
header('Location: index.php?msg=' . urlencode(base64_encode("Sorry That Code Wasn't Right!")));
}
ob_end_flush();
?>
Once the user logs in the session is suppose to be set. Now i am trying to use $_SESSION['user'] in my MYSQL Update where clause on a different page like so:
(register.php):
$sql="UPDATE supplier_session SET form1_completed = 'Yes' WHERE form1_completed = 'No' AND session_number = ".$_SESSION['user']."";
the problem i am getting is my mysql update script fails, with no error, but i am guessing $_SESSION['user'] is not defined and i somehow need to carry this session over to every page?
Can someone please show me where i am going wrong

Answer 1

One thing you might want to try is putting the session_start() call at the top of the script.
But why re-invent the wheel? This is especially true when it concerns security of your site. You're using database code that leaves you open to SQL injection attacks. I'm gonna guess you're storing user passwords in plain text too. You're just wide open for problems.
You really ought to go with something like http://www.php-login.net.