You can figure out how long they've been signed on by adding a row called "login_time" to your SQL table.
Then, when they login insert time() into the login_time. This will put a unix timestamp into that column.
To kill a session, you need somthing like this
<?
##### logout.php #####
// Clear the session array
$_SESSION = array();
// Destroy the session
session_destroy();
// Send the user back to the homepage
header("Location: /index.php");
?>
HTH