为什么我的会话超时注销无法正常工作？

Question

It should logout after 20 mins of inactivity but it logs out after 3-4 seconds, I don't know where I'm going wrong. I know other questions are out there but I've looked and can't find fix.

<?php

session_start();
if ((isset($_SESSION['Username']) && $_SESSION['Username'] != "") || (isset($_SESSION['uID']) && $_SESSION['uID'] != "") || (isset($_SESSION['Password']) && $_SESSION['Password'] != "")) { 

$selectUsers = $PDO->query("SELECT * FROM `users` WHERE uID='{$_SESSION['uID']}'");
$getRow = $selectUsers->fetch(PDO::FETCH_ASSOC);

if ($getRow['lasthit'] == time()+20*60) {
session_destroy();
session_unset();
$PDO->query("UPDATE `users` SET online=0 WHERE uID='{$_SESSION['uID']}'");
header("Refresh:3; URL=login.php");
} else {
$updateLastHit = $PDO->query("UPDATE `users` SET lasthit=NOW() WHERE uID='{$_SESSION['uID']}'");    
}  


} else {
header("Refresh:3; URL=login.php");
echo '<p class="error">You need to login, you are being redirected to login page.</p>';
endPage();
}

?>

Answer 1

Assuming that $getRow['lasthit'] contains the correct value, I think that you're using the wrong formula here:

if ($getRow['lasthit'] <  time()+20*60) {

With the current code, it will always return true since time() will return a value higher than $getRow['lasthit'] . This formula should work:

if ((time() - $getRow['lasthit']) >  20*60) {

Answer 2

if ($getRow['lasthit'] == time()+20*60) {

should be:

if ($getRow['lasthit'] < time()-20*60) {

You're looking for an exact match, and you're also adding instead of subtracting.

Change your SELECT query to:

$selectUsers = $PDO->query("SELECT UNIX_TIMESTAMP(lasthit) lasthit FROM `users` WHERE uID='{$_SESSION['uID']}'");

so that it will return an integer, not a timestamp, which you can compare with PHP's now() .