Introduction
In the previous tutorial, we built the User Login System that allows registered users to log in using their email and password. After a successful login, the system creates a session to remember the logged-in user.
In this part of the project, we will learn how to manage user sessions and implement the logout functionality.
Sessions play an important role in authentication systems. They allow websites to keep users logged in while they navigate between pages. Without sessions, users would need to log in again every time they visit a new page.
We will also create a logout system that allows users to safely end their session and log out of the website.
By the end of this tutorial, your login system will be able to manage user sessions and allow users to log out securely.
What You Will Build in This Part
In this tutorial, we will implement the following features:
- Understanding how PHP sessions work
- Protecting pages that require login
- Creating a logout system
- Destroying sessions securely
- Redirecting users after logout
These features are essential for building a complete authentication system.
What Are PHP Sessions?
A session is a way to store user information on the server so it can be used across multiple pages.
When a user logs in successfully, we store some data in the session such as the user ID or username. This allows the website to remember that the user is authenticated.
Sessions remain active until:
- The user logs out
- The session expires
- The browser is closed (in most cases)
Sessions are commonly used in login systems to maintain the login state of a user.
Starting a Session
Before using sessions, we must start the session at the beginning of the PHP script.
This is done using the session_start() function.
Example:
<?php
session_start();
?>
This function must appear before any HTML output. Otherwise, PHP will generate a header error.
Protecting a Page Using Sessions
Some pages should only be accessible to logged-in users. For example, a dashboard page should not be visible to users who are not authenticated.
To protect a page, we check whether the session variable exists.
Example code for dashboard.php:
<?php
session_start();
if(!isset($_SESSION['user_id'])){
header("Location: login.php");
exit();
}
?>
Explanation:
- The script starts a session.
- It checks whether the user session exists.
- If the session does not exist, the user is redirected to the login page.
This ensures that only logged-in users can access the dashboard.
What Is Logout?
Logout means:
- Ending the user’s session
- Removing stored session data
- Preventing access to protected pages
Creating the Logout File
To log out a user, we create a file called:
logout.php
This file will destroy the active session.
Destroying the Session
To log out a user, we must destroy the session data.
Example logout code:
<?php
session_start();
// Remove all session variables
session_unset();
// Destroy the session
session_destroy();
// Redirect to login page
header("Location: login.php");
exit;
?>
How Logout Works
session_start()→ Access sessionsession_unset()→ Remove session datasession_destroy()→ Destroy session- Redirect user to login page
This ensures that the user is fully logged out.
Adding a Logout Button
To allow users to log out easily, we can add a logout button on the dashboard page.
Example:
<a href="logout.php">Logout</a>
When the user clicks this link, the logout script will run and end the session.
Example Dashboard Page
Below is a simple dashboard page that displays the logged-in user’s name.
<?php
session_start();if(!isset($_SESSION['user_id'])){
header("Location: login.php");
exit();
}
?>
<!DOCTYPE html>
<html>
<head>
<title>User Dashboard</title>
</head>
<body><h2>Welcome <?php echo $_SESSION['user_name']; ?></h2><p>You are successfully logged in.</p><a href="logout.php">Logout</a></body>
</html>
This page checks whether the user is logged in and displays their name.
If someone tries to open the dashboard without logging in, they will be redirected to the login page.
Prevent Logged-in Users from Accessing Login Page
Add this at the top of login.php:
<?php
session_start();
if (isset($_SESSION['user_id'])) {
header("Location: dashboard.php");
exit;
}
?>
Same logic can be applied to register.php.
Testing the Logout System
To test the logout system, follow these steps:
- Start your local server.
- Register a user account.
- Log in using the login page.
- You will be redirected to the dashboard.
- Click the Logout link.
If everything works correctly:
- The session will be destroyed.
- The user will be redirected to the login page.
If the user tries to access the dashboard again, they will be redirected to the login page.
Destroy Session on Browser Close (Optional)
PHP sessions usually expire automatically, but you can configure:
ini_set('session.cookie_lifetime', 0);
This ensures session ends when browser closes.
Common Beginner Mistakes
Here are some common mistakes beginners make when working with sessions:
- Forgetting to call
session_start() - Trying to destroy sessions without starting them
- Outputting HTML before starting the session
- Not protecting restricted pages
- Forgetting to redirect users after logout
Avoiding these mistakes will make your authentication system more reliable.
Practice Tasks
Try these tasks to practice what you learned.
- Task 1: Create the
logout.phpfile. - Task 2: Add session destruction code.
- Task 3: Protect the
dashboard.phppage using session checks. - Task 4: Add a logout link to the dashboard page.
- Task 5: Test whether users can access the dashboard without logging in.
Conclusion
In this tutorial, we learned how to manage PHP sessions and implement the logout functionality in our login system. Sessions allow websites to remember logged-in users and protect restricted pages.
We also created a logout system that safely destroys the session and redirects users back to the login page.
With the registration system, login system, and logout functionality completed, we now have the core components of a basic user authentication system.
In the next tutorial, we will add additional improvements and security features to make the system more robust and practical.