Redirecting me to login page after validation

Question

I put a validation check on my page so that it is only accessible via login, but the problem is that after logged in header redirects it to to the log in page meaning it fails the log in check. I am typing the correct credentials and i have started the sessions, but still no idea what is wrong. I really appreciate your help.

login.php

    <?php
session_start();
include("dbConnection.php");
if(isset($_POST['username']) && isset($_POST['pass']))
{
$username = $_POST['username'];
$password = $_POST['pass'];

$query = mysql_query(" SELECT * FROM login WHERE username='$username' and password='$password'");
if($username == 'alex' && $password == 'lion'){
header('Location: alex.php' );
exit();
}
?>

<form class="login100-form validate-form" method="POST">
<span class="login100-form-title p-b-37">
Sign In
</span>

<div class="wrap-input100 validate-input m-b-20" data-validate="Enter username or email">
<input class="input100" type="text" name="username" placeholder="username or email">
<span class="focus-input100"></span>
</div>

<div class="wrap-input100 validate-input m-b-25" data-validate = "Enter password">
<input class="input100" type="password" name="pass" placeholder="password">
<span class="focus-input100"></span>
</div>

<div class="container-login100-form-btn">
<button class="login100-form-btn">
Sign In
</button>
<?php if(isset($_GET['error'])==true){
echo'<strong><p align ="center" id="wrong" color ="red">Wrong Username or Password !!</p></strong>';
}?>
</div>

alex.php

<?php
  ob_start();
  include("dbConnection.php");
 if(!isset($_SESSION['username'])){
   header("location:login.php");
}
  ?>

Answer 1

Your first problem is you have to start the session in your "alex.php" file. Add following line in the top of your code.

session_start();

Your second problem is, you are validating user whether they have loggined or not using the variable $_SESSION['username'] But after successful validation you are not setting $_SESSION['username'] in "login.php" file.

So your code must be like this:

if($username == 'alex' && $password == 'lion'){
    $_SESSION['username'] = 'alex';
    header('Location: alex.php' );
    exit();
} 

In you logout function don't forget to unset that session variable

unset($_SESSION['username']);

Answer 2

Inside your second if block , you're not setting a value for $_SESSION['username'] which is needed in alex.php to further validate login.

Right after:

if($username == 'alex' && $password == 'lion'){

Insert the following statement:

$_SESSION['username'] = $username; .

And in alex.php, you need to do session_start(); as your first statement for $_SESSION['username'] to be accessible.

Again in alex.php, use the following code so that if the referrer page is not login.php, it will redirect to login.php.

Right after:

ob_start();

Add:

if(basename($_SERVER['HTTP_REFERER']) != 'login.php'){
   header('Location: login.php' );
   exit();
}