PHP：删除给定id的另一个会话

Question

I have the following problem:

1. User X login in PC1, with session_id 1000. Leaves but forgot logout.
2. User X login in PC2, with session_id 1001.
3. Before session 1000 timeout, user Y get access in PC1 as user X, with session_id 1000.

In this way, two users get access as the same user, in different PCs, and different session ids. What I wanna do is store the new session_id each time a user login (done), and delete the previously stored session_id. But I don't know how to delete or modify a session file given the id, without changing the current session.

I mean, I wanna do the following:

1. User X login in PC1, with session_id 1000. Script stores 1000 as last_session_id. Leaves but forgot logout.
2. Same user login in PC2, with session_id 10001. Script get last_session_id (1000) and delete that session info; then stores 1001 as the new last_session_id.
3. User Y goes to PC1, with session_id 1000, but can't get access as X because the info was deleted.

Can *session_id(old_session)* work properly? Or that function just rename the current session id, but mantain the values?

Thanks in advance.

Answer 1

I found this

$session_id_to_destroy = $sessionid;
// 1. commit session if it's started.
if (session_id()) {
    session_commit();
}

// 2. store current session id
session_start();
$current_session_id = session_id();
session_commit();

// 3. hijack then destroy session specified.
session_id($session_id_to_destroy);
session_start();
session_destroy();
session_commit();

// 4. restore current session id. If don't restore it, your current session will refer to the session you just destroyed!
session_id($current_session_id);
session_start();
session_commit();

It worked perfectly for me.

Answer 2

From my experience, I use one table to store data related to the session. The table contains two or more fields of userID, lastSessionID. On your system just need to get the sessionId and userID then compare it to the last sessionID stored in the db refers to the same userID. If U get the same sessionID than continue but if different redirect page to logout. But, to use this method, you should keep a userID and sessionId into the db every time user login.