$creds = array(
               array( 'username' => 'john123',
                      'password' => 'hello'),
               array( 'username' => 'lucyliu',
                      'password' => 'dieblackmamba')
                   //more sub arrays like above here
         );

$username = $_POST['username'];
$password = $_POST['password'];

$match = false;
for($i=0;$i<count($creds);$i++) {
    if(strcmp($username,$creds[$i]['username']) == 0) {
        if(strcmp($password,$creds[$i]['password']) == 0) {
            // start session and set something to indicate that user is logged in
            session_start();
            $_SESSION['authenticated'] = true;
            $_SESSION['username'] = $creds[$i]['username'];
            $match = true;
        }
    }
}

if($match) echo 'Login successful: welcome ' . $creds[$i]['username'];
    else echo 'Invalid credentials';

session_start();
if($_SESSION['authenticated'] === true) {
     echo 'User ' . $_SESSION['username'] . ' is logged in.';
}

$_SESSION = array();
	// If it's desired to kill the session, also delete the session cookie.
	// Note: This will destroy the session, and not just the session data!
	if (isset($_COOKIE[session_name()])) {
		setcookie(session_name(), '', time()-42000, '/');
	}
	// Finally, destroy the session.
	session_destroy();