In the logon.php, no HTMLout put will be go to browser. this is a total Php page. And one thing in the previous page where use give the username and password the form action will be post not the get. input type will be "password", instead of text.
Now, in the logon.php, check the username and match the password from database, and redirect it to your xxxx.php.