10

I have this code and need the code to add a logout button, can anyone write out the code for a log out button that will log out the user, I read something about destroy session but do not know how to write the code out, thank you!

<?php
    include 'connection.php';
    //start of checking if user is logged in code
    if (!valid_credentials) {
    header('Location: login.php');
    exit();
    }

$_SESSION['user'] = 'username';


if (!isset($_SESSION['user'])) {
    header('Location: login.php');
    exit();
}
    //end of logged in code and starting a session

$query = "SELECT * FROM people";
$result = mysql_query($query);
While($person = mysql_fetch_array($result)) {
    echo "<h3>" . $person['Name'] . "</h3>";
    echo "<p>" . $person['Description'] . "</p>";
    echo "<a href=\"modify.php?id=" . $person['ID']. "\">Modify User</a>";
    echo "<span> </span>";
    echo "<a href=\"delete.php?id=" . $person['ID']. "\">Delete User</a>";
}
?>
<h1>Create a User</h1>
<form action="create.php" method="post">
    Name<input type ="text" name="inputName" value="" /><br />
    Description<input type ="text" name="inputDesc" value="" />
    <br />
    <input type="submit" name="submit" />
</form>
0

2 Answers 2

31

Instead of a button, put a link and navigate it to another page

<a href="logout.php">Logout</a>

Then in logout.php page, use

session_start();
session_destroy();
header('Location: login.php');
exit;
5
  • 1
    session_unset is from the deprecated session API before $_SESSION existed. Use unset, or don't call it at all as you're destroying the session anyway. Aug 31, 2012 at 5:41
  • This is insane. Logout button should be POST, not GET.
    – Nakilon
    Apr 11, 2017 at 10:49
  • 4
    @Nakilon Classic case of complicating things when not necessary. Do you see any data being passed via the anchor link? There is absolutely no need to go for POST when everything is already being done on the server side.
    – asprin
    Apr 12, 2017 at 3:36
  • 1
    @asprin, it is just HTTP stardard -- if you change smth on server (invalidating session) it should be POST. Imagine if I in my SO profile edit the image src="" to point not to projecteuler site but to "/logout". You'll be logged out when you look in my profile. It is fundamental that logout button should be POST.
    – Nakilon
    Apr 12, 2017 at 14:28
  • @Nakilon By that logic, I can modify the post variables pretty easily too. If someone is skilled enough to know how to alter GET, he will surely know how to do the same for POST too.
    – asprin
    Apr 13, 2017 at 6:30
7

When you want to destroy a session completely, you need to do more then just

session_destroy();

First, you should unset any session variables. Then you should destroy the session followed by closing the write of the session. This can be done by the following:

<?php
session_start();
unset($_SESSION);
session_destroy();
session_write_close();
header('Location: /');
die;
?>

The reason you want have a separate script for a logout is so that you do not accidently execute it on the page. So make a link to your logout script, then the header will redirect to the root of your site.

Edit:

You need to remove the () from your exit code near the top of your script. it should just be

exit;
6
  • 1
    Why is there an extra die even after the redirect?
    – ina
    Oct 30, 2013 at 23:05
  • 1
    @ina good question. The reason the die is on there is because if you ever want to continue after the header redirect, it die prevents code from being executed after you redirect. In this case it is not really needed but it is good practice if you plan to do more after the redirect.
    – Mic1780
    Oct 31, 2013 at 15:15
  • use $_SESSION=[];, unset($_SESSION) will make you can not recreate session.
    – sfy
    Jan 24, 2016 at 13:44
  • 1
    @wolfrevo Better to use $_SESSION = array();
    – Keno
    Apr 24, 2018 at 4:43
  • do I need to die or exit() at the end? Oct 23, 2020 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.