Question

I am writing a script which is supposed to end a session for a user, and log them out of the system, thus returning them to the login page.

My logout script looks like this:

<?php

$_SESSION['signin'] = null;

session_destroy();

header("Location: /test/index.php");

?>

Initially I reset the signin variable that way even if the session isn’t destroyed the variable should have at least changed so that the system believes the user is logged out.

And at the top of my login page I have a condition to forward them to the home page if they are already logged in, that way that can’t visit the log in page once already logged in. This portion looks like this:

<?php
session_start();
if($_SESSION['signin'] == 5)
{
        header("Location: /test/home.php");
}
?>

So in short, when someone is logged in, and clicks the link to logout it utilizes the first code block to log out, and then is forwarded to the page containing the second blcok of code.

However, this page still forwards me back to the home page, believing the user is still signed in and thus I’m guessing the signin variable was not reset.

Thoughts on how to solve my issue?

Answer 1

session_destroy() does not unset any of the global variables within the session. Simply using:

session_unset();

to unset all global variables, or to only unset the specified variable, use:

unset($_SESSION['signin']);