logout script

[eiuser]

I am using following code to set the session when login :

function set_session($value, $table_name)
{
$value_rec = mysql_fetch_array($value, MYSQL_ASSOC) ;
session_start() ;
$SESSION['username']=$value_rec['username'] ;

$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'] ;
$_SESSION['logged'] = 1 ;

$session_id = session_id() ;

$query = "update ".$table_name." set session = '".$session_id."',
ip = '".$_SERVER['REMOTE_ADDR']."' where username = '".$value_rec['username']."'" ;

mysql_query($query) ;

return ;

}

Now login works fine. It creates a unique session id and stored relevant variables (e.g. logged, ip etc..) in the file named
sess_{{here comes session id}} under directory c:\php\sessiondata.

Now I am using following script at logout time:

function log_out()
{
$SESSION['logged'] = 0 ;
$SESSION['ip'] = 0 ;
$SESSION['username']= "" ;
}

Even after I logout, $_SESSION variables still hold values. That is probably because when I unset session variables in logout script, it is not reflected in the file, which is under sessiondata directory.

Can any body tell me the solution as how can I make sure that once I logout, nobody can access the pages without login again ?

I am sure I need some changes in logout script.

Hope I made the problem clear. I am using PHP 4.3, Xitami Web server and MySQL.

Thanks,
dev

[Moonglobe]

i think you're looking for session_destroy()?

[edit]and maybe:

setcookie("PHPSESSID");//destroys session cookie?

[/edit]

[eiuser]

Thanks a lot for your time.

I used

session_unset() ;

session_destroy() ;

but still problem is not solved...

I think here is some problem with my basic understanding.

If we unset and destroy the session, does it really delete the
sess_(session_id) file from the c:\php\sessiondata ???

Because I think each time it reads any variable like $_SESSION['logged'], it actually reads it from above file.

In that case it must be deleted when we log out... Is that true ?

[Moonglobe]

i really wouldn't know sorry........ i've never worked with session files, only cookies, so i can't solve your problem... poke around the usernotes in the manual they might have something useful.

sry 🙁
moon

[eiuser]

Thats fine. By the way, I found where I was wrong.

session_destroy() is ofcourse the key.

It was not working with me, because, I was checking logout script in a new browser window, and that was trying to eliminate a new session, and not the old one.

Thanks for all your help.

[Moonglobe]

np, glad you've fixed it.