i'm suspecting that i've been up too long and there's something obvious i'm missing. remember that these things are case sensitive.
SELECT * FROM tblUsers WHERE Username='$username'

also, if you can do a straight-forward select * then it should work. failing that see whether you can select * from x where id=1?

Yep doing a straight forward * works, doing where ID=1 works, but anything from $_SESSION or $_COOKIE that i try to concatenate in the mysql_query doesn't. I was doing it late on Friday thinking same thing, tried it over weekend still can't get my head around it.

So that would mean that WHERE Username='sniper' works, right? if that is the case i stick to the browser binding cookie issue as it works on a free remote server. I'll have to sleep on it mate. I'll have a think and get back to you. if you manage to hack it though i would love to know what the issue was.

Yep
Works: SELECT * FROM tblUsers WHERE Username='sniperkid'
($username = $_SESSION['username']
Doesn't: SELECT * FROM tblUsers WHERE Username='$username'
($usertest = "sniperkid"
Works: SELECT * FROM tblUsers WHERE Username='$usertest'

Thanks for your input, i will look into that and let you know!

this is going to make me pop my clocks. can you do me a favour and see whether you can pass it as a $_GET variable? it's driving me insane.

yep, $_GET and $_POST work fine (its why i didn't notice the issue until now )

okay, now this may sound weird but it works with a lot of odd javascript. try $username="".$_SESSION['username']; and see whether that changes anything. or maybe $username=trim(" ".$_SESSION['username']);

ok $username = "".trim($_SESSION['username']); works!!!!! I will use this, thanks alot!!!

that is weird. seems like the variable was passing a reference rather than the actual value. adding the "".x to it forces it to create a new string. the trim function was supposed to do the same. anyway, glad to be of help. you know it'll probably be better if you did an $username=htmlspecialchars($_SESSION['var']); instead. it would not only make it harder to hack, but it should force a string rebuild too.