PHP - 管理会话 - 不注销

Question

I have created a user authentication system with necessary DB tables and php.

THe first time before I login (Before any SESSION is created) the redirect on every page works perfect (ie Redirects to the login page if not logged in).

But once I login with a user and then logout the same doesnt work. I think it might be a problem with not ending the SESSION (Sorry if am wrong)

Here are some pieces of the code in each Page

Login PHP

    <?php
session_start();
$message="";
if(count($_POST)>0) 
{
    include('config.php');
    echo $_POST['username'];
    $result = mysql_query("SELECT * FROM members WHERE username='" . $_POST["username"] . "' and password = '". $_POST["password"]."'");
    $row  = mysql_fetch_array($result);
    if(is_array($row)) 
    {
    $_SESSION["id"] = $row[ID];
    $_SESSION["username"] = $row[username];
    $_SESSION["password"] = $row[password];
    $_SESSION["mname"] = $row[mname];
    $_SESSION["fname"] = $row[fname];
    date_default_timezone_set("Asia/Calcutta");
    $lastlog=date("d/m/Y");
    $logtime=date("h:i a");
    $query = "UPDATE `members` SET `lastlogin`='$lastlog',`logintime`='$logtime' WHERE `ID`='$row[ID]'"; 
    mysql_query($query);
    $_SESSION['logged'] = TRUE; 
    } 
    else 
    {
        echo "<SCRIPT>
        alert('Wrong Username/Password or Awaiting Approval');
        </SCRIPT>";
        header("Location:login_failed.html");
    }
}
if(isset($_SESSION["id"])) {
header("Location:member/myprofile.php");
}
?>

PHP code on every page

<?php
session_start();
include('config.php');
if(!$_SESSION['logged'])
{
header("Location: ../login.html");
exit;
} ?>

And Finally Logout

    <?php
session_start();
unset($_SESSION["id"]);
unset($_SESSION["username"]);
unset($_SESSION["password"]);
unset($_SESSION["mname"]);
unset($_SESSION["fname"]);
header("Location:../login.html");
?>

Is there any problem with my Code. Am i missing something? I couldn't get it right. Pls Help

Thanks guys got it solved..

Now can you tell me How I can redirect login.php to user home page(myprofile.php) in case the User is logged in (Session exists) - Like facebook,gmail etc

Answer 1

Instead of calling unset() on each session var, you can simply use session_destroy(), which will destroy all of the current session data.

session_start();
session_destroy();
header("Location:../login.html");

For complete destructive power, you might also want to kill the session cookie:

setcookie(session_name(), '', 1);

See this question for a more complete example of session logout.