[Resolved] Strange Session Problem

[PiercedKnob]

Hi everyone,

I was hoping someone could help with this minor problem. A user is created in my database and they login, creating session variables 'logged_in' and 'siteusername'. This works a treat, sort off.

During my testing in the office, a work mate created an account then logged in. I deleted his account in my database and he shut down Internet Explorer (instead of clicking the logoff button which does a session_unset();.

When he went back onto my website, he was still logged in ? I thought the Session variables die when Internet Explorer is shut down so i cannot understand why he is still logged in.

Can anyone explain why this should be happening ?

Kind Regards

Wayne

[PiercedKnob]

More Info :-

I have done more testing and it appears that if you logoff (i am using the following code just to be on the safe side

  $_SESSION['logged_in']=0;
  $_SESSION['siteusername']='';
  unset($_SESSION['logged_in']);
  unset($_SESSION['siteusername']);
  session_unset();

if you then click to login and don't enter a password or anything, the $SESSION['siteusername'] & $SESSION['logged_in'] still holds the previous values.

If you then navigate through my site its as if you are not logged in. its very strange.

To help you understand. I have the login box on the left hand side of my website, this is a page called sidebar.php which i include in every page.

This has some code in to detect if you are logged in, it will check for the $SESSION['logged_in'] variable being set. If it is then it will display a Welcome $SESSION['siteusername']. So, when you click Login, the login screen runs (this sidebar.php displays 'checking your details'. Then you get sent to the Login Failure screen however the sidebar.php code is displaying the previous siteusername & logged_in session variables.

If you then start to navigate the site, you then end up with the sidebar.php code displaying the login prompt. I cannot make any sense from it so any help would be great, please.

[PiercedKnob]

Sorry ppl, found the problem.

I was checking the username & password and if it wasn't correct, redirecting to the loginfailure page. I forgot to put a die; command in and as such it was setting the $_SESSION variables before it get the redirect in.

Kind Regards

Wayne