PHP unset unknow session id

Question

I've a login system written in PHP. When you login successfully;

<?php $_SESSION[session_id()] = "yourMemberIDHere"; ?>

When you log off;

<?php unset($_SESSION[session_id()]); ?>

Here is my problem. Admin can ban members. Banned members cannot login. But when a member gets banned while he/she online, it does not log off. Because I only do control of ban state at login.

So I know that somewhere in $_SESSION[] array a value equals to "myBannedMemberID". How can I find that $_SESSION key and unset it?

I thought foreach can be useful. But what if there are thousands of members online on my system?

Answer 1

You can search in all the sessions:

foreach ($_SESSION as $name => $value) {
    if ($value == 'myBannedMemberID') {
       unset($_SESSION[$name]);
    }
}

Answer 2

try with php function array_search

$key = array_search($myBannedMemberID, $_SESSION);
unset($_SESSION[$key]);

Documentation: http://php.net/manual/en/function.array-search.php

Answer 3

Try something like this:

<?php
if(isset($_SESSION['myBannedMemberID'])){
    unset ($_SESSION['myBannedMemberID']);
}
?>

You can also see all the items in the $_SESSION array by simply printing it like this:

 print_r($_SESSION);

Hope this helps.

Answer 4

My previous answer was simply an example of unsetting that $_SESSION variable. But to actually kick that user off, you should probably write a function that checks the database for blocked or banned users, and if a row is returned for that users ID, you destroy their session and have a header redirect that brings them to the home page of your site or wherever you want to take them.

You'll then need to check if that user is blocked or banned in the login script as well.

I hope this advice helps you further.

Answer 5

So you want to force logout someone who is logged in but got banned?

You pretty much need to do that where you store the current user's session information. Therefore either by checking user validity from db (or so) on each pageload OR going through session storage one by one and just delete the entry.

If you are using default settings (file based sessions), you could scandir(session_save_path()) and check each file, until you find the correct userid from there and delete the file.

EDIT: And to read the data correctly from these files (or where ever you store your data), check out this comment in php.net: http://php.net/manual/en/function.session-decode.php#108037