Yeah, close.
But instead of

PHP: Select all

$_SESSION['user'] = $username.$key; 

Set them seperately in the session like this...

PHP: Select all

$_SESSION['user'] = $username;
$_SESSION['key'] = $key; 

Then you don't have to seperate the joint strings when checking