How do I protect pages using sessions PHP?

coviex...

I tried your solution to question #1...

What I did was place the code you provided me with onto let's say (members.php and admin.php):

<?php
if (!isset($_SESSION['logged_in'] ))
{
    header("Location:index.php");
}
?>

Now, without logging in, I try to access those pages by typing in the full url...The result takes me to index.php.  When I try to login, the result takes me to index.php.  I can't get anywhere but the index...So then I was thinking that I should change the header on each page the code was pasted on, to that page's location...I tried that, and the result was the page loading very slow until it eventually timed out.

Maybe there is something I'm doing wrong?  Or maybe I didn't post the code on the right pages?  Can you clear some things up as to where I'm supposed to put the code, and am I supposed to change anything according to what page it is?

Thanks

i guess you have included some common file e.g. header.php or something like that on every page and you can use this logged in check script on that page

Awesome...That is working!  Before I award points, hopefully someone can help me with question #2.  I'm still having troubles with that.

I currently have a field set up in my SQL database titled ,"Level_access".  In order to redirect a user to a certain page after login, how should I approach it, again?  I couldn't get the switch method coviex suggested working...Any final help??  Thanks!!!!!!

Here is my index.php once more:
==============================================
<?php
require_once('db.php');
include('functions.php');

if(isset($_POST['Login']))
{
      if($_POST['username']!='' && $_POST['password']!='')
      {
      //Use the input username and password and check against 'users' table
      $query = mysql_query('SELECT ID, Username, Active FROM users WHERE Username = "'.mysql_real_escape_string($_POST['username']).'" AND Password = "'.mysql_real_escape_string(md5($_POST['password'])).'"');
                  
            if(mysql_num_rows($query) == 1)
            {
            $row = mysql_fetch_assoc($query);
            if($row['Active'] == 1)
                  {
                  session_start();
                  $_SESSION['user_id'] = $row['ID'];
                  $_SESSION['logged_in'] = TRUE;
                  header("Location: members.php");
                  }
                  else {
                  $error = 'Your user account was not activated. Please open the email that was sent and click on the activation link.';
                  }
            }
            else {            
            header("Location: login_fail.php");            
            }
      }
                     else {
      $error = 'Please enter both your username and password to access your account';
      }
}
?>

Here's a possible example: Add a field to your table named `access` field type ENUM ('1','2','3')
in your sql query add the `access` field to the list then:
<?
switch($row['access']) {
    case 1:
          header("Location: access1.php");
          break:
    case 2:
          header("Location: access2.php");
          break:
    case 3:
          header("Location: access3.php");
          break:
    default:
          header("Location: index.php");
}
?>  

Now .. the big thing about header redirecting is that there can not be anything ANYTHING echo'd out prior to calling the header. No spaces or line breaks outside of PHP <? ?> tags or anything.

ZSoderquist don`t you think that reposting other's code is not very nice?!

Alright.  I did as both ZSoderquist and Coviex suggested by using the switch case in my index.php.

Now, the result is whenever the correct username and password has been entered, it takes you nowhere, and instead reloads the index.php, which is the login page.

I have posted the index.php, which contains the updated code using switch statements.  Please let me know if something is wrong within my code.  Any last suggestions?  Thanks!

index.php
============================================
<?php
require_once('db.php');
include('functions.php');

   if(isset($_POST['Login']))
   {
      if($_POST['username']!='' && $_POST['password']!='')
      {
      //Use the input username and password and check against 'users' table
      $query = mysql_query('SELECT ID, Username, Active FROM users WHERE Username = "'.mysql_real_escape_string($_POST['username']).'" AND Password = "'.mysql_real_escape_string(md5($_POST['password'])).'"');
                  
            if(mysql_num_rows($query) == 1)
            {
                  $row = mysql_fetch_assoc($query);
                  if($row['Active'] == 1)
                  {
                        session_start();
                        $_SESSION['user_id'] = $row['ID'];
                        $_SESSION['logged_in'] = TRUE;
                              
                        switch($row['Level_access'])
                        {
                            case 1:
                        {
                                 header("Location: control_panel.php");
                                  break;
                        }
                            case 2:
                        {
                                  header("Location: members.php");
                                  break;
                        }
                        }
                  }
                  else {
                  $error = 'Your user account was not activated. Please open the email that was sent and click on the activation link.';
            }
      }
            else {            
            header("Location: login_fail.php");            
            }
      }
      else {
      $error = 'Please enter both your username and password to access your account';
      }
}
?>

<?php if(isset($error)){ echo $error;}?>

Yes.  Thank you!
I must have overlooked that so many times!!!

I award ZSoderquist with the points, thanks to being very clear in his instructions, and for his continued help!

coviex:  ZSoderquist don`t you think that reposting other's code is not very nice?!

coviex, I apologize, I didn't know you were the creator of the switch statement, even though yours is syntatically incorrect :) .. btw, I'm here to help people, I could care less about the points. Maybe you could try that sometime :)

dialeradmin, thanks for the grade and good luck.

ZSoderquist: maybe you`ll try to read some manual on switch statement. i`m sure you`ll find something new for you in it`s syntax =) Or i have even better advise - don`t spent so much time helping people, find yourself a paid job =)