I've decided to go a different route.

Instead of sending users to the index page when they try and log in without a username/password, I'm now sending them to a page which tells them the area they're trying to get into is restricted and they need to log in.

On reflection, I think that's probably better from a usability point of view - makes it obvious to the user that they've done something they're not allowed to do, rather than just loading a normal page which looks similar to the secure area.

Thanks for all the help though guys and gals. I've learnt so much about PHP this week. Feels rather good.

__________________
www.veryconscious.com