php session

[kiLLer.zoh_1]

Hi all this is my index page it works fine but the only porblem is that when user close the tab without
logging out then login.php page displayed with menu obove.i want to expire the session if user close the tab
help me out please

<?php 
session_start();
if(!isset($_SESSION['_LOGIN']))
{
    $_SESSION['_LOGIN'] = 0;
}
include 'inc/db.php';
$page = isset($_GET['page']) ? trim ($_GET['page']):NULL;

include 'inc/shtml.php';

include 'inc/header.php';

include 'inc/nav.php';

if (($page != NULL) && ($_SESSION['_LOGIN'] == 1))
{
    include "inc/c_".$page.".php";
}
else
{
    include 'inc/login.php';
}
include 'inc/footer.php';
?>

[Atli]

i want to expire the session if user close the tab

There is no reliable way to determine when a user closes a window/tab. There are some JS events that might be able to detect it, but seeing as it's up to the user whether or not to even allow JS to be executed, it's not something you can rely on happening.

The de facto standard for handling these types of situations is to have the session time out after a certain amount of time. So if the user closes the tab/window, the user will remain "active" for X number of minutes, after which the session will be considered expired. - By default, PHP sessions time out after 24 minutes.

You can either rely on PHP's mechanism for expiring sessions, or you can simply record visitor activity times in the session itself, and then examine the time difference each visit to see if X number of minutes have passed, and then manually expire the session.

[IIM]

There is an event ,onunload in javascript that is called when the window is closed.You can fire this event to invalidate the session.Add this event on the body,so whenever your html body is unloaded,this event is fired,and inside this event,invalidate session.

The other way around is as Atli discussed above.In all server side programming language,there is a way to timeout session after a particular duration.Use the same to invalidate session if the user is idle after specified time.

[Atli]

There is an event ,onunload in javascript that is called when the window is closed.

Just to highlight this fact again, because in this context it is extremely important to understand. This JavaScript event MIGHT be called when the window closes. It's not guaranteed; it's not a reliable method, because it's a client controlled action. It can be turned off; it can be ignored.

As an auxilary method, it's fine, but you will most definiely want to have a primary method that relies on server-side code. Anything that happens in JavaScript, or otherwise on the client, is unrealiable.

There is another concern worth noting about this event, even though it doesn't appear to affect this particual situation. (Mostly posting this for the benefit of others in simular situations.) - That is, it fires whenever any tab or window closes. These days people have gotten into the habit of using multiple tabs to navigate sites. If your site relies on a session, and somebody opens a link within your system in a new tab, when that second tab is closed, the event will fire and invalidate the session. This will also affect the first tab.