This isn't the only way to do it, but here's what I've done in the past...
For each page a user views, I update their last access time in a table.
Then when I want to show all the users online, I query that table for everyone who has had an access time within 10 minutes (you can change this to whatever you want).
Users who leave your site or walk away from their computer will no longer appear in the list after 10 minutes.
If you were looking for instant on/off status, that gets a bit more difficult and starts involving JavaScript (which as you know can be disabled).