<?php
    session_start();
    function validate() {
        if (empty($_POST['username'])) return false;
        if (empty($_POST['password'])) return false;
        if ($_POST['username'] != 'foo') return false;
        if ($_POST['password'] != 'bar') return false;
        // Otherwise all validation is passed user may be granted access
        $_SESSION['auth'] = true;
        return true;
    }

    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        if (!validate()) {
            $msg = "User authentication failed!";
        }
        else {
            $msg = "User authentication passed!";
        }
    }

if (!empty($msg)) {
?>
<p><?php echo $msg; ?></p>
<?php
if (empty($_SESSION['auth'])) {
?>
<form method="post">
<p>Username: <input type="text" name="username" /></p>
<p>Password: <input type="password" name="password" /></p>
<input type="submit" value="Log In" />
</form>
<?php
} else {
?>
<h1>Welcome foo!</h1>
<?php
}
?>