Try this example:
The idea is to have a UID variable which is the unique user ID on the dbase. Once you submit your login parameters (password, username) it runs checkLogin. If the pair matches it returs the UID and sets in in a cookie plus a TH (hash value which is unique in time) so you cant steal a session through cookies robbing. Once the UID is set it is recovered on every post and checked with the TH throuh validateLogin(). If the system smells something funny it resets UID (sets it to 0) and that automatically logs you out since there is no user with UID ==0. Check out the if statements you see that once the Logout button is pressed UID is set to 0 thus killing the session.
Saludos
Gerardo
PS a the code is based on class programing that is why you'll see a lot of $this->blablablas
if (1==1) {
// success binding to dbase
// load session if possible else load default login values
session_start();
// echo "AFTER SESSION START USER STATUS IS ".$GLOBALS["UID"].":".$GLOBALS["TH"].":<br>";
$this->user["logged"]["UID"]=$GLOBALS["UID"];
$this->user["logged"]["TH"]=$GLOBALS["TH"];
$this->_loadSession();
// continue configuring
$this->user["logged"]["login"]=1;
while ($this->user["logged"]["login"]==1) {
switch ($this->user["logged"]["status"]) {
// if not logged
case 0:
if (isset($this->form_input["page"]["button"]["logout"])) { // logout
$this->user["logged"]["login"]=0;
}
if (isset($this->form_input["page"]["button"]["doregistration"])) {
$this->user["logged"]["status"]=10;
}
if (isset($this->form_input["page"]["button"]["dologin"])) {
if ($this->_checkLogin()) {
// if log valid
$this->user["logged"]["status"]=1;
} else {
// if log invalid
$this->user["logged"]["status"]=0;
}
$this->user["logged"]["login"]=0;
}
$this->user["logged"]["login"]=0;
break;
// if logged
case 1:
if ($this->_validateLogin()) {
// if log valid
if (isset($this->form_input["page"]["button"]["logout"])) { // logout
//remove the local session
session_destroy();
//remove the client session
setcookie("SES_NAME","","","/");
// echo "loging out<br>";
$this->user["logged"]["status"]=0;
$this->user["logged"]["login"]=1;
$this->user["logged"]["UID"]=-1;
$this->user["logged"]["TH"]="";
//echo "CLOSING LOGIN<br>";
} else {
// echo "keeping login<br>";
$this->user["logged"]["login"]=0;
}
} else {
// if log invalid
//remove the local session
session_destroy();
//remove the client session
setcookie("SES_NAME","","","/");
// echo "loging out<br>";
$this->user["logged"]["login"]=1;
$this->user["logged"]["status"]=0;
}
break;
// if registration
case 10:
$this->user["logged"]["login"]=0;
break;
} // switch user logged status
} // while user login in process status>10
if ($this->user["logged"]["status"]==1) {
$GLOBALS["UID"]=$this->user["logged"]["UID"];
$GLOBALS["TH"]=$this->user["logged"]["TH"];
} else {
$GLOBALS["UID"]=-1;
$GLOBALS["TH"]="";
}
session_register("UID");
session_register("TH");
//echo "BEFORE REGISTER GLOBALS[UID]=".$GLOBALS["UID"]." GLOBALS[TH]=".$GLOBALS["TH"]."<br>";
} else {
// try restart mysqld
// terminate email admin
}
