I've looked at the docs and searched this board. I've read lots of stuff, but I still can't seem to get a user "logged off."
The login form is pretty basic, the same type if thing that I've seen in several posts on this board:
<-- some HTML stuff -->
<?php
session_start();
echo session_id(); // for debugging purposes.
if (! isset($SESSION['username'])) {
if (isset($POST['username'])) {
// Set the session variables.
} else {
// Display the login form
}
}
if (isset($_SESSION['username'])) {
// Display the admin page.
}
?>
On the admin page, I've got a line that echos the session ID and username, with a link to click to log out. The link opens the killSession.php file:
<?php
$SESSION = array();
session_unset();
unset($COOKIE[session_name()]);
if (session_destroy()) {
print "Session destroyed.<br />\n";
} else {
print "Session not destroyed.<br />\n";
}
if (isset($_SESSION['username'])) {
print "Logout failed.";
} else {
print "Logged out.";
}
?>
I've tried this with just the session_unset() function, with just the $_SESSION = array() function, with and without trying to unset the cookie, etc. My output is always the same:
Session not destroyed.
Logged out.
When I browse back to the admin page, whether it's using the back button (with and without a manual refresh) or by typing in the URL anew, I get the same output I had before: the same session ID, the same username, and the admin page contents instead of the login form.
What am I doing wrong here? Why can't I get rid of the session variables? I've checked the session file in the /tmp directory, and all the data is still there after trying to empty the session variables. If the session isn't destroyed, I can see why maybe I'm getting the same output when going back to the admin page: it's looking in the file in the /tmp directory and pulling that stuff up. But shouldn't either the $_SESSION = array(); or the session_unset() function get rid of the contents of that file, so that even if the session isn't destroyed, at least the variables will be done away with?
I'm using PHP5 on Solaris, if that makes any difference. Most of the php.ini file parameters are set to the defaults (the session.save_path directive was commented out by default, but I uncommented it so that /tmp is used).
Thanks for any assistance you can provide,
Rich
p.s.: Sorry about the formatting, I haven't figured out how to make the PHP stuff indent the way it should.
