You can pretty much do it the way you have. Before I started using sessions, I used a cookie rather larger than that one that stored username, email addy, and login status. A couple of things worth mentioning...
Your header() call can't work if anything has been sent to the browser, (i.e., in your case, any echo() calls...) so you'll have to figure out how you want to indicate the the user that he has been auth'd without printing that out until after the header. Of course, the issue there is that you're sending him/her to another page....
If you wanna try it with sessions, I took the liberty of editing your code to do so:
<?php
session_start(); # must do this on each page a $_SESSION var is needed/used
$Username = $_POST['username'];
$Password = $_POST['password'];
$loginpage = "http://www.google.com/login.htm";
$users = array();
$users[0] = array("user1", "pass1", "http://www.google.com.au/user1");
$users[1] = array("user2", "pass2", "http://www.google.com.au/user2");
$users[2] = array("user3", "pass3", "http://www.google.com.au/user3");
$member = null; # not necessary to declare vars, unless you just want to...
$loggedin = 0; # ditto
$members = count($users);
for($x=0; $x<$members; $x++){ # OK, we'll be looping 3 times...
if(($Username==$users[$x][0])&&($Password==$users[$x][1])){
$_SESSION['loggedin'] = 1; # assign a logged in status to this var
$_SESSION['member'] = $x; # assign the users' number to this var
header("Location: ".$users[$x][2]); # send this user to his successpage
} # otherwise, we try again
} # if none of the 3 user/pass combos match, then:
echo "You don't have permission to view this area. ";
echo "<a href=\"$loginpage\">Please log in.</a>";
?>
Hope it works, and hope it helps! Welcome to PHP....
