End sessions by id.

[l3mon]

I am new to PHP and I am building a PHP blog/user system thing. It's coming together pretty well. Right now I just got the user system running. Im using the session code form this tut. I found that when I delete a user from the database the user is still logged in. When I develop further it will cause problems for sure. So I was thinking I could store the users last session's id in the db. And then when I run delete the user also run a script that would end a session by it's id. Is there any way to do that? I looked around but couldn't find any.

[TheServant]

Will you be deleting users often while they could still be online? THere are a few different ways. I am not sure, but maybe you can do as you say and store the session id in the database which can be recalled by session_id() and then cleared, or maybe something with session_destroy()?

I think you need to work hard at working out if you should be deleting from your database, because if someone is using your system, surely they want confidence that they have control on when it is deleted? By leaving it in their hands they can delete it and then run a session_destroy() to log them out.

I'll have a look around for remote session_destroying for you.

[l3mon]

I looked around but didn't see anything. I was thinking something like this.

<?php
session_destroy($sessionid);
?>

[TheServant]

SOunds like a plan. Really you should do session_unset() and session_destroy() together so that there is no way of keeping those variables alive. Give it a go and let me know how it turns out.

[l3mon]

No dice.

Warning: Wrong parameter count for session_destroy() in .../PHP/test.php on line 4

The code I was using:

<?php
$id = $_GET['id'];
session_unset($id);
session_destroy($id);
?>

So it's not failing the session_unset, however it's not doing anything (I tested both alone as well)

[TheServant]

I must apologise, I cannot test this stuff while I'm at work, and I was hoping for someone to be able to solve this off the top of their head. Try setting your session as the target session using:

$id = $_GET['id'];
session_id($id);
session_unset();
session_destroy();

[l3mon]

Nope:

Warning: session_destroy() [function.session-destroy]: Trying to destroy uninitialized session in /home8/boagloba/public_html/site3-phnx/PHP/test.php on line 5

And no worries about not being able to test it. The fact that your helping is wonderful!

[numberwhun]

@l3mon
Correct me if I am wrong TheServant, but I think that the session_destroy() function does not take any arguments. That would be why you are getting the error(s).

Plus, the unset mentioned should only be used for older, deprecated code. Instead, you should use:

$_SESSION = array();
 

Regards,

Jeff

[l3mon]

@numberwhun
I am really new to PHP; only about a week or so and I don't know where I would plugin my session id.

[numberwhun]

@l3mon
That's ok, I am not exactly a veteran myself, but you need to know how to use the php online manual.

Take a look at and read this page. You will see that none of the examples use a session id as it kills the active session. Read the comments below as well as plenty is explained. Also, read the other command(s) pages off on the left side.

Its important to know your resources and how to use them. This one is invaluable.

Regards,

Jeff

[TheServant]

@numberwhun
Yeah, that's what I thought but couldn't test it at the time. Anyway, l3mon, you had before $_GET['id']? How do you get that session? I ask because from my understanding, or lack of it, you should be able to set your session with session_id()? If it says that there is no session initialized, you have forgotten session_start(), are getting the wrong id with $_GET['id'], or it doesn't work how I thought.

Unfortunately I have not had much time at home to help out, so just going through some things that I would test for if I was at home :P

[Markus]

Hey, guys.

OP, how're you setting your session? May we take a peek, please.

Thanks

- markus.

[l3mon]

@TheServant
I just took the id out of the cookie it automatically set in my browser.

[l3mon]

I know that that is right because I tried to modifies the content of cookie and it messed up but when I put it back to what it was it worked fine.