Question

I’m creating session variables with every login it’s $_SESSION[‘usr’] & $_SESSION[‘psw’]. When I log out I’m destroying them with this code:

<?php
session_start();
session_destroy();
if(count($_SESSION) == 0)
{
$_SESSION=array();
session_destroy();
}
header("Location:home.php");
?>

What I’m trying to do is to restricted some of the pages only for logged in users so I tried to use this little piece of code:

<?php if(!$_SESSION['usr']){header('Location:home.php');} ?>

I don’t understand why it’s not working, because it’s making total sense but it doesn’t anyone any idea why? Thank you for all your help…

Answer 1

You shouldn’t be trying to destroy the session twice.

It should be:

<?php
  session_start();   
  $_SESSION = array();
  //Session Cookie
  if (ini_get("session.use_cookies")) {
      $params = session_get_cookie_params();
      setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
      );
  }
  session_destroy();
?>

http://php.net/manual/en/function.session-destroy.php

There’s no need to check if something’s set.
And the check should probably be:

<?php if(!isset($_SESSION['usr'])) {
   //header() - see below
} ?>

And the Location needs to be an absolute url (e.g. http://www.mydomain.com/home.php)