Don't allow new user, if a user has already logged in - php

Question

error_log('my test');
if(isset($_SESSION["userName"])){
// some user is present CHECK AND ALLOW THE LOGIN.
// Another user has already logged in. so check if the last session activity is more than the SESSIONTIMEOUT value.
$idleTime = (time() - $_SESSION['LAST_ACTIVE_TIME'])/60;
$idleTime=9;$sessionTimeOut=10;
if($idleTime<$sessionTimeOut) {
print("*****1*****");
$existingUser=$_SESSION["userName"];
// IDLE TIME IS LESSTHAN THE SESSIONTIMEOUT SO ONLY ALLOW IF IT IS AN OLD USER
if(strcasecmp( $existingUser, $name ) == 0){
print("*****2*****");
$_SESSION["userName"] = $name;
$_SESSION["ipaddr"] = $ipaddr;
$_SESSION["type"] = $type;
$_SESSION['LAST_ACTIVE_TIME'] = time();
updateUserInfo($name,$ipaddr,$type);
$url ="./PHome.php" ;
// header("Location: $url");
} else {
print("*****3*****");
// IDLE TIME IS LESSTHAN THE SESSIONTIMEOUT AND new user, SO don't allow
$url ="./Login.html" ;
//header("Location: $url?error=duplicateErr");
}
} else {
print("*****4*****");
// IDLE TIME IS MORE than sessionTimeOut, SO NEW SECOND USER HAS LOGGED IN
$_SESSION["userName"] = $name;
$_SESSION["ipaddr"] = $ipaddr;
$_SESSION["type"] = $type;
$_SESSION['LAST_ACTIVE_TIME'] = time();
updateUserInfo($name,$ipaddr,$type);
$url ="./PHome.php" ;
// header("Location: $url");
}
} else {
print("*****0*****");
error_log("errors occured");
// No user is present So Log in
$_SESSION["userName"] = $name;
$_SESSION["ipaddr"] = $ipaddr;
$_SESSION["type"] = $type;
$_SESSION['LAST_ACTIVE_TIME'] = time();
updateUserInfo($name,$ipaddr,$type);
$url ="./PHome.php" ;
//header("Location: $url");
}
// Logic,
First I am checking if the user has already logged in, if not I am allowing the user to Login,
Now if a second user comes since the session is already set it should not allow the user to login, But this is allowing.
Test Scenario - Login using Chrome first and then using an IE, a second user is able to log in.
I Can't use a database, as the db is getting locked and the whole application dies.
Any help is highly appreciated.

Answer 1

Though I'm not sure if you are trying, to stop a same "user" from "same ip" to login is different, but if you want to stop multiple logins in same user this can be the technique
Add a field in DB beside the user
On login turn it to 1 (You should keep an inactivity timer though to make it 0 after some hours/minutes)
While login just add a statement to check if that field is 0 or 1