There are a couple of other things that are worth looking at:

• Never use the return value of mysql_query() without making sure it is valid.
  

  // Either do:
  $result = mysql_query($sql) or die(mysql_error());
  
  // Or, if you don't want the error to show on
  // production servers (which you shouldn't):
  $result = mysql_query($sql) or trigger_error(mysql_error(), E_USER_ERROR);
  
  // You could also just do:
  $result = mysql_query($sql);
  if ($result) {
      // ...
  }
  else {
      trigger_error(mysql_error(), E_USER_ERROR);
  }
  
  

  
  
  
• Don't SELECT * if you don't intend to use ALL the data. Your SELECT statements should never fetch fields you don't intend to use. Otherwise you are just wasting resources. - If all you need is to count the number of rows the query would return, use the SQL COUNT() function:
  

  $sql = "SELECT COUNT(*) FROM members 
          WHERE username='$username' 
          AND   password='$password'";
  $result = mysql_query($sql) or trigger_error(mysql_error(), E_USER_ERROR);
  
  $row = mysql_fetch_row($result);
  $count = $row[0];
  
  

The header's already sent error is given when some form of output has been sent to the browser, as an echo or a print, or a php error/notice, or sometimes even whitespace. So you need to make sure that in all the lines leading up to the header() call, nothing is sent to the browser. So for example, if there was an error with one of your mysql functions that output an error to the browser, that would cause the header's already sent message.

So check what's happening on line 9.


As for "sending the password"... why do you want to send the password? You have already checked that the password is correct when they've logged in, you don't need to do anything else with it now. Use the username as the session to identify them.

If you really think you need to store the password in a session, first explain to me/us why you want to do that and what you are planning to do with the password session to need to do it.

At the top of your checklogin.php page, put:

session_start();

That will..start a session.

Then when you want to set the user's session, instead of using register, do:

$_SESSION['username'] = $username; // Or whatever you want to store in the session

I would also strongly advise you not to store the password in a session, there is no point to it and only leads to possible/probable security problems.