login

Between line 24 and 25, put echo $sql; and see what is generated. One of your functions can introduce unexpected results.

Nevermind, after writing more codes I pass the login page.

admin.php

session_start();
if(!session_is_registered('username')){
header("location:index.php");
}
?>

Deprecated: Function session_is_registered() is deprecated in C:\xampp\htdocs\RustoleumCustomCMS\administrator\admin.php on line 63

why is deprecated?

if(isset['$username'])
{
}

put all your code in this condition and also check the out put of your query using echo and use die(mysql_error()); for any db error

Are you sure that works arti18? I am sure that it would be actually something like:

if(isset($_SESSION['username']))
{

}

Parse error: syntax error, unexpected '[', expecting '(' in C:\xampp\htdocs\RustoleumCustomCMS\administrator\admin.php on line 62

pixelsoul is correct. You could also do these things I beleive

if(!empty($_SESSION['username']))
{
}
//or
if(($_SESSION['username']) != null)
{
}

I change some code in order to encrypt the password:

proses.php

<?php

$servername = "localhost";
$username = "root";
$password = "";
$database = "rustoleum";

mysql_connect($servername, $username, $password) or die("Not connected");
mysql_select_db($database) or die("Not connected to the database");


/* the files */

// username and password sent from form
$username=$_POST['username'];
$password=$_POST['password'];

// To protect MySQL injection (more detail about MySQL injection)
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$encrypted_password = MD5($password);

$sql=("SELECT * FROM user WHERE username='$username' and password='$encrypted_password'") or die(mysql_query);
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

echo $count; 
// If result matched $username and $password, table row must be 1 row

if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("username");
session_register("password");
header("location:admin.php");
}
else {
echo "Wrong Username or Password";
}
?>

admin.php

<?php

// Check if session is not registered, redirect back to main page.
// Put this code in first line of web page.

if(isset($_SESSION['$username']))
{
    session_start();
    if(!session_is_registered('username'))
    {
    header("location:index.php");
    }
}

?>

I wonder why now I can enter the admin page without login just by typing the url. In this case, I already Logout - which will direct me to index.php.

index.php

<?php
// Put this code in first line of web page.

session_start();
session_destroy();
?>

md5 is okay, sha1 would be better. Also, why are you destroying the session right after you start it?

There are some points which i have asked below.

   <?php
     session_start(); 
   if(!isset($_SESSION['username'])) 
    {
       session_destroy();
       header("location:index.php");

    }
    ?>

Instead of this why don't you just try

admin.php

if(isset($_SESSION['$username']))
{
session_start();
}
else
{
header("location:index.php");
}

This time I wonder why I cannot login at all? (I'm in the middle of trying few posibilities).

What's the difference between:

$_SESSION['$username'] and session_is_registered('username') ?

I find the solution:

admin.php

session_start();

if(!$_SESSION['username'])
    {
    header("location:index.php");
    }