Every time the user interacts with the site, record the time that they do so.
Then, when you're wanting to show who's online, list those whose last interactions are less than [use your judgment here] minutes old. Any older, and you assume they've left (if they leave and don't tell you, you have no way of knowing it).
If you give them the option of deliberately logging out (so that they can tell you you're leaving), set that time to something way in the past when they do so.
That's about the best you can do, given that http (deliberately) doesn't keep track of site visitors from instant to instant to see if they're still there.
