php - Session are not working -

hello have created login system not working reason , start session after 1 login , made check if session isset , if session no more 1 hour :

this login script on index.php :

<?php require 'mysql.php';  if(isset($_session["username"]) && time() - $_session["created"] > 3600){     session_start();     session_unset();     session_destroy();   }   if(isset($_session["username"]) && time() - $_session["created"] < 3600){      header('location: main.php'); }    if (isset($_post["login"])){      $username = $_post["username"];     $password = $_post["password"];      $stmt = $connect->prepare("select username, password users username=? ");     $stmt->bind_param("s", $username);     $stmt->execute();     $result = $stmt->get_result();     $rowcount = $result->num_rows;         if ($rowcount > 0){                  while ($row = $result->fetch_assoc()) {                     if ($row["username"] == $username && $row["password"] == $password){                          if(!isset($_session)) {                              session_start();                         }                             $_session["username"] = $username;                             $_session["usertype"] = $row["usertype"];                             $_session["userid"] = $row["id"];                             $_session["created"] = time();                         header('location: main.php');                      } else {                         $error_msg2 = "username or password not mach";                         $error2 = "error";                     }                 }         } else {             $error_msg2 = "no such user";             $error2 = "error";         }      echo $error_msg2;     $stmt->close();     $connect->close();  }  ?> 

and main.php code :

if(isset($_session["username"]) && time() - $_session["created"] > 3600){     session_start();     session_unset();     session_destroy();       header('location: index.php'); }  

so ones login redirected main.php , if session set u should unable access index.php cuz if try u , session not expired redirected main.php same main if session expired redirected index.php login , no matter if logged in or no can walk between them freely

you should call session_start in case - fills $_session values. it's enough unset $_session['username'], no need destroy whole session - php can take care of that. here code should work:

index.php

<?php require 'mysql.php';  session_start(); if (isset($_session['username'])) {     if ($_session['created'] < 3600) {         header('location: main.php');         exit;     }      unset($_session['username']); }   if (isset($_post['username']) && isset($_post['password'])) {     $username = $_post['username'];     $password = $_post['password'];      $stmt = $connect->prepare('select username, password users username=? limit 1');     $stmt->bind_param('s', $username);     $stmt->execute();     $result = $stmt->get_result();     $rowcount = $result->num_rows;      if ($rowcount > 0) {         $row = $result->fetch_assoc();          if ($row['username'] == $username && $row['password'] == $password) {             $_session['username'] = $username;             $_session['usertype'] = $row['usertype'];             $_session['userid'] = $row['id'];             $_session['created'] = time();              header('location: main.php');             exit;         } else {             $error_msg2 = 'username or password not mach';             $error2 = 'error';         }     } else {         $error_msg2 = 'no such user';         $error2 = 'error';     }      echo $error_msg2;     $stmt->close();     $connect->close(); } 

main.php

session_start(); if (!isset($_session['username']) || time() - $_session['created'] > 3600){     unset($_session['username']);     header('location: index.php');     exit; }