<?php
error_reporting(E_ALL); //para que muestre todos los errores
session_start();
include("config-main.php");

if (isset($_POST['entrar']))
{
	$user = $_POST['user']; //filtrar esto
	$pass = md5($_POST['pass']);

	$query = mysql_query("Select * from login where User='$user'");
	$resultados = mysql_num_rows($query);

	if ($resultados > 0)
	{
		$query2 = mysql_query("Select pass from login where User='$user'");
		$contra = mysql_fetch_array($query2);

		if ($pass == $contra['pass'])
		{			
			$_SESSION['user'] = $user;
			header("Location: Principal.php");
		}else{
			echo "Les contrasenyes no coincideixen.<br /><a href='index.php'>Tornar enrere</a>";
		}

	}else{
		echo "No s'ha trobat l'usuari.<br /><a href='index.php'>Tornar enrere</a>";
	}
}
?>
<form name='login' method='post' action='index.php'>
<input type='text' name='user' /><br />
<input type='password' name='pass' /><br>
<input type='submit' value='Entrar' name='entrar' /><input type='reset' value='Esborrar' />
</form>

<?php
session_start();

if (isset($_SESSION['user']))
{ 
	echo "Aqui deberia mostrar el contenido";
} else {
	header("Location: index.php");
}
?>

$query = mysql_query("Select * from login where User = $_SESSION['user']");

<?php
  foreach ($_POST as $key => $value) {
    $$key = limpia($value);
  }
?>

<?php
  foreach ($_POST as $key => $value) {
    $_POST[$key] = limpia($value);
  }
?>