如何防止用户使用用户 session_destroy 访问管理页面

Question

I want to prevent logged in users from accessing admin page with their session when they are logged in. they should only be able to log in only with username 'admin'.

   session_start(); 

   if (!isset($_SESSION['username'])) {
      $_SESSION['msg'] = "You must log in first";
      header('location: login.php');
   }

   if (isset($_SESSION['username']) != 'admin') {
      session_destroy();
      unset($_SESSION['username']);
      header("location: login.php");
   }

   if (isset($_GET['logout'])) {
      session_destroy();
      unset($_SESSION['username']);
      header("location: login.php");
   }

Answer 1

if (isset($_SESSION['username'])) {
   if($_SESSION['username'] !== 'admin'){
     session_destroy();
     unset($_SESSION['username']);
     header("location: login.php");
   }

} else {
   $_SESSION['msg'] = "You must log in first";
   header('location: login.php');
}

the isset function would return a boolean value and must not be checked against string.

Answer 2

if (isset($_COOKIE[session_name()])) {
            setcookie(session_name(), '', time() - 86400, '/');
}
session_destroy();
header("location: login.php");
exit();

session_destroy() is not enough. you should expire cookie too.

and always use exit(); after header('location=...');