@@Here's the login page ...

<?php
ob_start();

// stop errors on multiple session_start()
if(session_id() == '') session_start();

header("Cache-control: private"); // IE 6 Fix.
require_once 'functions.php';
require_once 'lang.php';
$config = SXConfig();
include 'header.php';

?>
<div id="content" class="login">
<form method="post" action="<?php echo $_SERVER['SCRIPT_NAME']; ?>">
<p><label for="username">Username:</label> <input type="text" name="username" id="username" /></p>
<p><label for="password">Password:</label> <input type="password" name="password" id="password" /></p>
<p><input type="submit" class="submit button" value="Login" /></p>
</form>
<p class="request"><a href="pwd-request.php">Request new password</a></p>
<?php
$auth=0;

if($_POST) {
	$error = SXLoginCheck($_POST,$config['prefix']);
	if (trim($error)=='') {
		list($_SESSION['member_id'],$_SESSION['username'],$_SESSION['full_name'],$_SESSION['super_user']) = SXUserLogin($_POST,$config['prefix']);
		header("Location: ".$config['uri'].$config['path']."admin/add.php");
		exit;
	}
	else {
		echo '<p class="error">'.$error.'</p>';
		$_POST['password'] = '';
		include 'footer.php';
		exit;
	}
}
include 'footer.php';
ob_end_flush();

?>

@@Then on any other pages, SXAuthenticate is called to make sure the user is logged in, which is where I think the problem is.

function SXAuthenticate() {
	global $txt;
	if (!isset($_SESSION['member_id']) || ($_SESSION['member_id'] == '')) {
		echo $txt[11];
		exit;
	}
}

@@This is from Saxon News if anybody uses it, by the way.