pass $_Session variable outside wordpress

I wrote a login script and stored in shortcode Exec PHP as [login]

$login = mysql_query("SELECT * FROM users WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . mysql_real_escape_string(md5($_POST['password'])) . "')");
if (mysql_num_rows($login) == 1)
	{
        // Set username session variable
        $_SESSION['username'] = $_POST['username'];
	$_SESSION['password'] = $_POST['password'];
	while ($row = mysql_fetch_assoc($login))
	{
		$_SESSION['priv'] = $row['priv'];
		$_SESSION['email'] = $row['email'];
	}
	header("Location: http://employee_intranet/Index.php");
	die();
}
?>
<table align="center">
<form method="post" action="">
<tr><td align="left"><p class="whitetext">Username:</p></td><td align="left"><input type="text" name="username"></td></tr>
<tr><td align="left"><p class="whitetext">Password:</p></td><td align="left"><input type="password" name="password"></td></tr>
<tr><td><input type="submit" value="Login"></td></tr>
</form>
</table>

After a bunch of “headers already sent by” errors, I finally added this to wp-content/themes/headway-2013/library/core/layout.php:

session_start();
ob_start();

[login] shortcode is placed on my wordpress “login” page and after successful auth. I’m redirected to http://employee_intranet/Index.php

so far so good…..

however, when arriving at http://employee_intranet/Index.php, I dont’ have access to $_SESSION[‘username’] that was set on my original wordpress “login” page??

I even temp. disabled wp_unregister_globals in wp-settings.php and still can’t access session var’s on http://employee_intranet/Index.php

any advice?