Securely pass variable data to different php file - php

Question

I'm trying to make a dashboard after my userlogin, however I want it on a different page. But I'm afraid passing data via url might not be necessary caused it can be changed manually. I want to pass $username to my dash.php file. Here's my code:
login.php
<?php
session_start();
//Insert Connection String
require_once 'config.php';
if(!$_SESSION['username']){
if (!isset($_POST['submit'])) {
echo'<form action="login.php?logged=yes" method="post">';
echo'<label> Username</label>';
echo'<input type="text" name="username"/>';
echo'<label> Passowrd</label>';
echo'<input type="password" name="password"/>';
echo'<input type="submit" name="submit" value="Login!"/>';
echo'</form>';
} else {
//handle some errors
//If both fields are empty
if(!$_POST['username'] && !$_POST['password']) {
echo"Try to login without entering any info, genius.";
}
else {
//check if the username exists
if(!empty($_POST['username'])) {
//check if the password exists
if(!empty($_POST['password'])) {
//Put unencrypted username variable
$username = $_POST['username'];
//Encrypt the values
$xusername = md5($_POST['username']);
$xpassword = md5($_POST['password']);
//Check if they exist in the database
$query = odbc_exec($conn, "SELECT * FROM xmember WHERE username='$xusername' AND password='$xpassword'");
$user_rows = 0;
while ($row = odbc_fetch_array($query)) {
$user_rows++;
}
odbc_free_result($query);
if($user_rows == 1) {
echo 'Welcome, '.$_POST['username'];
$_SESSION['username'] = $_POST['username'];
echo "<meta http-equiv='refresh' content='3;url=dash.php'>";
}
else {echo"Sorry, your account information is invalid.";}
}
else {echo"Please put your password";}
}
else {echo"Please put your username";}
}
}
else {echo"what are you doing here?";}
?>
config.php
<?php
/*
Le Change Nickname PHP v1.0 made by Thor KK Klein LOL
CONFIG section
*/
//Set Network Config
$odbc_dsn = "mydb";
$odbc_user = "sa";
$odbc_password = "wh#tTh3!?";
$conn = odbc_connect($odbc_dsn, $odbc_user, $odbc_password);
if(!$conn) {die('Failed to connect to the database!');}
?>
dash.php
<?php
session_start();
require_once 'login.php';//load connection settings and get info
if(!$_SESSION['username']){
echo"Are you kidding me?";
}else {
//Display The Dashboard
//Get user's typical information
//Get user's table row array
echo"Welcome, ".$username;
}
?>
I tried require-once'ing login.php to my dash.php to get the data.. but it doesn't seem to work.

Answer 1

Sinde you store the username in the session variable, you can access it from any file usibg $_SESSION["username"]. If the key is not set, you can redirect the user to your login page.
Your 'dash.php' file could be modified like this:
<?php
require_once("config.php");
session_start();
if(!isSet($_SESSION["username"])) {
// Redirect user to login page
header("Location: login.php");
exit();
}else {
//Display The Dashboard
//Get user's typical information
//Get user's table row array
echo("Welcome, " . $_SESSION["username"]);
}
?>