Well, you could create a field in MySQL called.. "last_action" lets say. Store the last unix timestamp that the user did anything on the forum/site/whatever in that field.
Then, define what "online" means. Visited in the last 10 minutes? 5 minutes? Just compare the unix timestamp from the MySQL field with 5 minutes ago like:
$last_action = time(); // pretend right now is their last action
if((time() - $last_action) <= 300) { // 300 = 5 minutes (60 secs * 5 mins)
$online_list .= ", $username";
}
The above script used examples, but that should give you the basic idea.