Cannot log out from session

Question

When I try to log out the session is destroyed but I still can go inside that page and view details without logging in first by using the Mozilla browser back button or history cache.

code for logout is

<php
session_start();
session_unset($_SESSION['user']);
//redirect to login page
header('location:login.php');
session_write_close();
?>
members page.
<php
if(!isset($_SESSION['user'])||(trim($_SESSION['user']==''))){
require('error.php');
}
else{
require('view.php');
//the function queries the db.
member_detail($user,$password);
}

In this code if I use the link to the page, it goes to the error page but if I log in, member details is displayed since the session is active so problem is after logout.

Answer 1

first make sure your session is destroyed using session_destroy function or unset the whole session array.

and in print the session array in test page after logout. this will give you which session variables are there. use isset method to check whether or not session variables exist.

Answer 2

Sometimes session_unset and session_destroy does not clear the session data.

Reference: http://www.dmxzone.com/forum/topic/14240/

I have similar experience. Perhaps it is because of not using the methods properly.

Quickfix:

if you want to unset a particular session variable:

$_SESSION["variable"]="";

That will 'unset it'

To unset the whole SESSION

$_SESSION=array();

I seriously do NOT know how valid these are as recommended programming practices, however, they work for me.

FROM the manuals

If a globalized variable is unset() inside of a function, only the local variable is destroyed. The variable in the calling environment will retain the same value as before unset() was called.

and

session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. To use the session variables again, session_start() has to be called.

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

Perhaps other users can add more to this answer. Plus the manuals at php.net have very informative comments with sample code.