Two things
Once the user has failed the login you'll need to destroy the value of that session variable session. That way your values will be erased. This is done using session_unregister( var name)
Secondly you'll need to pass the values of the session variables to normal names. This makes it easier to remember.
SQL statement grabbing all my data
$first_name = $row["first_name"];
$Session["firstname"] = $first_name;
e.g $S_fname = $Session["firstname"];
now create a page that is included in all the other pages that you want the session data to be used in.
so if i have a all my session data in a file called session.php then so long as that page is included then i can use $S_fname.
hope this helps
GM