Security - Login system

Question

For a school project I have been asked to create a login system for a website. The language I have to use is PHP with no database as of yet (for a later assignment). I'm just wondering if this code has any security flaws.

Here is my current code:

Navigation.php note that this is to be included in another html document.

<link type="text/css" rel="stylesheet" href="style_nav.css">

<ul>
    <li><a href="index.php">Index</a></li>  
    <li><a href="test.php">Test</a></li>
    <li><a href="#">not-in-use</a></li>
</ul>

<div class="login" > 
    <?php
    session_start();

    $_SESSION['last_phage'] = $_SERVER['PHP_SELF'];

    if (empty($_SESSION['user'])) { 
        echo '
        <form action="login.php" method="POST">

        Username: <input type="text" name="username">
        Password: <input type="password" name="password">&nbsp;&nbsp;
        <input type="submit" value="Login">

        </form>';
    } else {
        echo 'Welcome! ' . $_SESSION['user'] . '<form action="login.php" method="POST"><input type="submit" value="logout" name="logout"></form>';
    }
    ?>

</div>

<br />
<br />
<hr />

Login.php

<?php

session_start();


if (isset($_POST['logout'])) {
    session_destroy();          
    header("Location: index.php"); 
}

if (isset($_POST['username']) && isset($_POST['password'])) {
    if (!empty($_POST['username']) && !empty($_POST['password'])) { 
        $username = $_POST['username']; 
        $password = $_POST['password']; 

        if ($username == 'kad' && $password == 'lol') {  //this is just temporary without a database
            $_SESSION['user'] = $username;

            header("Location:" . $_SESSION['last_phage']);
        }

        header("Location: " . $_SESSION['last_phage']); 
    }
}
?>

Answer 1

Here's my 2 cents as Java "developer" with a little experience in c# and vba.

Your security here largely depends on whether you send the password and username in clear text or encrypted. You should force HTTPS protocol for access to the page.

You might also want to show errors if the login is invalid:

$valid = true;
if(!isset($_POST['username']) || empty($_POST['username'])){
   $errors .= "Please enter a username.<br>"
   $valid = false;
}
if(!isset($_POST['password']) || empty($_POST['password'])){
   $errors .= "Please enter a pasword.<br>"
   $valid = false;
}
if($valid){
  //check for username and password compliance
}

Also it would definitely be better to have the logout be handled in a different file than the login