Question

I can’t seem to find a straightforward answer to this question. Is there a way in which I can force a logged in user to logout? My login system essentially just relies on a session containing the user’s unique ID (which is stored in a mysql database). So essentially just…

if (isset($_SESSION['user_id'])) {
echo "You're logged in!";
} else {
echo "You need to login!";
}

But let’s say I want to ban this user, well I can change their status to banned in my database but this won’t do anything until the user logs out and attempts to log back in… So, how do I force this user to logout? Preferably without checking every single time they view a page whether or not their status has been switched to “banned” because that seems like unnecessary stress on my server. Any help is appreciated, thank you.

Answer 1

Either you need to check every time they load a page, or possibly look at an Ajax call at set intervals to check their status from the DB.

Then you can use session_destroy(); to end their session. This will destroy their entire session.

Otherwise you can use unset($_SESSION['user_id']); to unset a single session variable