Sessions and logging out with mdb2

[Joseph Grogan]

Hi all....
I have code here that allows me to login to an area of a site but loggin out you have to close down the browser and i dont want that i want a logout page.

Here is the code i using to log in

<?php
session_start();
require_once('***login page details****');
require_once('***Where Pear MDB2 is located****');;
if (empty($_SESSION['user_id'])) {

    if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) {
        header('WWW-Authenticate: Basic realm="Member Area"');
        header("HTTP/1.0 401 Unauthorized");
        echo "You must enter in a username and password combination!";
        exit;
    }
    
    $connection = MDB2::connect("mysql://$db_username:$db_password@$db_host/$db_database");

    if (MDB2::isError($connection)){
        die ("Could not connect to the database: <br />". MDB2::errorMessage($connection));
    }
    
    $username = mysql_real_escape_string($_SERVER['PHP_AUTH_USER']);
    $password = mysql_real_escape_string($_SERVER['PHP_AUTH_PW']);
    $query = "SELECT `user_id`, `username` FROM `users` WHERE
`username`='".$username."' AND `password`=MD5('".$password."') LIMIT 1";
    $result = $connection->query($query);
    
    if(!($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC))) {
        header('WWW-Authenticate: Basic realm="Member Area"');
        header("HTTP/1.0 401 Unauthorized");
        echo "Your username and password combination was incorrect!";
        exit;
    }
    
$_SESSION['user_id'] = $row['user_id'];
$_SESSION['username'] = $row['username'];
}

This works fine its just logging out wont work.. I have a page called logout.php

session_start();
session_destroy();
$_SESSION = array();
echo "Thank you for loggin out: ";

But this does not remove any details as when i go back to the login page all my information is still there...

 

[louie]

did you try unset?

unset($_SESSION['user_id']);
unset($_SESSION['username']);

 

[Joseph Grogan]

Hi louie. No that is not working either. Cant seem to figure it out.

Ok I have my session start in a file called authenticate.php and that is used on everypage of the directory so no page can be seen without a password. But do i need that authenticate.php page on the logout page so the session info can be unset do i just have the code you cave me by itself. Not really sure on what to do with it