PHP - Using A Logout Script (user Has To Click The Logout Link Twice)

For some reason my logout is not working properly.  I searched other forum posts and read some tutorials but I still have an issue.

Do this to create session:
Code: [Select]
$_SESSION['username'] = $row['username'];
setcookie('username', $row['username'], time() + (60 * 60 * 24 * 5));

Do this to log out the user
Code: [Select]
session_start();
session_unset();
$_SESSION = array();
setcookie(session_name(), '', time() - 3600);
session_destroy();
setcookie('username', '', time() - 3600);

Above all else I am trying to end the $_SESSION['username']

Thank you all

Hello, I'm currently storing a timestamp of the users last activity in my database in which if that hasn't been updated for 15 minutes (for testing doing 2 minutes) I want it to log the user out.

I have been trying different things but they all seem to log me out even though they shouldn't be. 

Example of something I've tried

	$Online = time() - 120;
	if ($CheckOnline['lastaction'] < $Online){
    header("Location: Logout.php");
    session_destroy();
}
	

Am I going at this the wrong way.? If I do $Online < $CheckOnline['lastaction'] it keeps me logged in but never logs me out.

 

Any help would be brillaint.

 

Thank you!

When writing a logout script in PHP what steps should i take? Should i:

1.) unset all session vars like:  

 unset($_SESSION["var1"]);
 unset($_SESSION["var2"]);

or calls   

session_unset();

2.) destroy session cookie like:

setcookie(session_name(), "NULL", time()-60, $params['path'], $params['domain'], $params['secure'], isset($params['httponly']));

3.) finally destroy the session data by calling

session_destroy();

or maybe just only unset the session vars - that is making only the first step?

I'm asking because I've seen many logout scripts that doesn't involve these 3 steps (i most cases doing only the first one as i stated)

Thx. for help.

Hey there guys, small problem here that I can't seem to figure out. I am in the process of programming a database with user-access control.  I have the log-in system working great, but the logout link, which is located next to the logged-in username seems to not be echoing correctly. It is loading the 'Logout' text in text-form only, not link-form....

Any ideas on what may be causing this small glitch?? Thanks!!   

I have attached relevant code for said part for reference.


<img src="images/username.png" height="20" width="20">&nbsp;<b>Welcome</b> <?php echo ("<font color=#9e0219>$username</font>");?>, <?php echo '<a href="logout.php">Logout</a>';?>

I based this off some other pages read, and think I'm doing this wrong or it's just not connecting. 

Code: [Select]
Here's the database table:
CREATE TABLE users (
    id INT NOT NULL AUTO_INCREMENT,
    username VARCHAR(30) NOT NULL UNIQUE,
    password VARCHAR(64) NOT NULL,
    salt VARCHAR(3) NOT NULL,
    PRIMARY KEY(id)
);


Ando far I have index.php with my login form <form name="login" action="login.php" method="post">
    Username: <input type="text" name="username" />
    Password: <input type="password" name="password" />
    <input type="submit" value="Login" />
</form><br />Would you like to <a href="register.php">register?</a></center>

Then I have my actual login on login.php (header.php includes website's main image as well as session_start():
<?php

include('header.php');

$username = $_POST['username'];
$password = $_POST['password'];
//connect to the database here
$username = mysql_real_escape_string($username);
$query = "SELECT password, salt
        FROM users
        WHERE username = '$username';";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such user exists
{
    header('Location: login.php');
    die();
}
$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
if($hash != $userData['password']) //incorrect password
{
    header('Location: login_form.php');
    die();
}
else
{
    validateUser(); //sets the session data for this user
}
//redirect to another page or display "login success" message
?>

then I have my register php on register.php:
<?php

include('header.php');

//retrieve our data from POST
$username = $_POST['username'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
if($pass1 != $pass2)
    header('Location: register_form.php');
if(strlen($username) > 30)
    header('Location: register_form.php');
    
    $hash = hash('sha256', $pass1);
    function createSalt()
{
    $string = md5(uniqid(rand(), true));
    return substr($string, 0, 3);
}
$salt = createSalt();
$hash = hash('sha256', $salt . $hash);

$dbhost = 'localhost';
$dbname = 'mygame';
$dbuser = 'root';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
mysql_select_db($dbname, $conn);
//sanitize username
$username = mysql_real_escape_string($username);
$query = "INSERT INTO users ( username, password, salt )
        VALUES ( '$username' , '$hash' , '$salt' );";
mysql_query($query);
mysql_close();
header('Location: login.php');

?>
and lastly the register form:
   
    <center><form name="register" action="register.php" method="post">
    Username: <input type="text" name="username" maxlength="30" />
    Password: <input type="password" name="pass1" />
    Password Again: <input type="password" name="pass2" />
    <input type="submit" value="Register" />
</form></center>
I am getting the errors:
Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /Applications/XAMPP/xamppfiles/htdocs/testing/login.php on line 13

Warning: Cannot modify header information - headers already sent by (output started at /Applications/XAMPP/xamppfiles/htdocs/testing/config.php:1) in /Applications/XAMPP/xamppfiles/htdocs/testing/login.php on line 15

Could someone explain why this is happening?