logging out a user completely from a website [duplicate] - php

Question

This question already has answers here:
PHP ending sessions(different ways) i dont understand
(2 answers)
Closed 9 years ago.
I have a PHP login and log out script and what I'm trying to achieve is that when the user click on the log out link he completely logs out, regardless clicking the back button of the browser, and do not want the user to access the page.they should be redirected to the login page
this is login function
function loggedin() {
if ( isset($_SESSION['user_id']) && !empty($_SESSION['user_id']) ) {
return true;
} else{
return false;
}
}
and this is my logout script
<?php
include 'includes/connect.php';
include 'includes/functions.php';
session_destroy();
header('location: index.php');
?>
how can i achieve this??

Answer 1

You can delete all cookies
if (isset($_SERVER['HTTP_COOKIE'])) {
$cookies = explode(';', $_SERVER['HTTP_COOKIE']);
foreach($cookies as $cookie) {
$parts = explode('=', $cookie);
$name = trim($parts[0]);
setcookie($name, '', time()-1000);
setcookie($name, '', time()-1000, '/');
}
}
http://www.php.net/manual/en/function.setcookie.php#73484
And if you have an array of cookie names used for login authentication, you should iterate the cycle only with them.

Answer 2

The question was logging out a user completely from a website and not just how do I destroy a PHP session, so my answer will be somewhat more complex.
Since you're using PHP's $_SESSION functionality to handle the user sessions, you can, in particular, tie the current session IDs to the user accounts. Then you can easily force the session to expire.
For example, create a new field in the user database, and call it active_session_id or something. Every time a user logs in, save the session_id() output to it. Then inside of your loggedin() function check if the session_id() of the current request matches the one saved when the user was logging in, and if it does not match, the function will return false, so this is how you virtually end a user session. I.e. even though it will still actually be there, it will not be valid anymore.
It is worth noting that the solution above would be sort of a one-to-one relation, i.e. one user will be able to have only one active session. If you want to allow users to come from different places at the same time, you'll have to maintain a one-to-many relation there by creating a new table called e.g. users_sessions and saving the session IDs there. Please do not create another fields in the current users table like active_session_id_1, active_session_id_2 etc. because it is not considered to be a good practice.
Hope this helps

Answer 3

You can write a generic function that checks if a user is logged in, if not just redirect them like this
function isLoggedIn(){
if (isset($_SESSION['user_id']) && !empty($_SESSION['user_id'])){
//do what you want
} else{
header("location:youloginpage.php");
}
}

Answer 4

If you do not specify more on your question, we can only procede by assumptions. Anyway, since you are using that SESSION, and it's not clear if you want to destroy the data contained or not, the function to check if user is logged in, could be modified this way:
function loggedin() {
if ( isset($_SESSION['user_id']) && is_numeric($_SESSION['user_id']) && ($_SESSION['user_id'] > 0) ) {
return true; //user is logged in
//other operations to be performed
} else{
return false; //user is NOT logged in
//other operations to be performed
}
}
The logout function could just be something like this:
function logout() {
if ( isset($_SESSION['user_id']) && is_numeric($_SESSION['user_id']) && ($_SESSION['user_id'] > 0) ) {
$_SESSION['user_id'] = -1; //"unsets" the user, while not destroyng session
} else{
return false; //user is already logged out - do nothing
}
}