Along with the username, store the timestamp of their last activity in the DB. Every time they click on a page, or do anything, you'd run a query similar to:
$query = 'UPDATE `usersOnline` SET `timestamp` = UNIX_TIMESTAMP() WHERE `username` = \'' . $_SESSION['username'] . '\' LIMIT 1';
That way, when you're SELECT'ing users to display that are "online", you would add an additional WHERE clause similar to:
WHERE `timestamp` > (UNIX_TIMESTAMP() - 900)
(900 seconds = 15 minutes).
Periodically, you would want to DELETE from the table where the timestamps are too old.
Alternatively, there are plenty of pre-made scripts that can do this. Check out either HotScripts or Google it.