Destroy session if user account is deleted from database but user is logged in

Question

I've created user system in Php. Now I want this that if I delete user account from database then session should be destroyed and user should be logged out and show him a message.

I have searched a lot and I get one from this (Stack Overflow) but that was not the answer of my question. Here is the link:destroy session after user is deleted but still logged in. I have checked these answers but these was not the answer of my question.

I know about function session_destroy() but how can I make it work as I want. How can it implement to do this work.

Here is the user login function code:

public function userLogin($data){
        $phone_number = mysqli_real_escape_string($this->db->link, $data['phone_number']);
        $password = mysqli_real_escape_string($this->db->link, $data['password']);

        if($phone_number == "" || $password == ""){
            $loginmsg = "<div class='alert alert-danger'>Phone number or Password must not be empty!<button type='button' class='close' data-dismiss='alert' aria-label='Close'><span aria-hidden='true'>&times;</span></button></div>";
            return $loginmsg;
        } else {
            $this->setSessionDuringLogin($phone_number, $password);
        }
    }

public function setSessionDuringLogin($phone_number, $password){
        $query = "SELECT * FROM users WHERE phone_number = '$phone_number' AND password = '$password'";
        $result = $this->db->select($query);
        if($result != false){
            $value = $result->fetch_assoc();
            Session::set("userlogin", true);
            Session::set("user_id", $value['user_id']);
            Session::set("first_name", $value['first_name']);
            Session::set("last_name", $value['last_name']);
            Session::set("email", $value['email']);
            Session::set("password", $value['password']);
            header("Location: profile.php");
        } else {
            $loginmsg = "<div class='alert alert-danger'>Email or Password is wrong.<button type='button' class='close' data-dismiss='alert' aria-label='Close'><span aria-hidden='true'>&times;</span></button></div>";
            return $loginmsg;
        }
    }

Well first of all, you would need that particular user’s specific, current session id … Do you have that? — misorude, Aug 23 '19 at 11:47
You'll need to check if the user has been deleted on every request. If you found them to be deleted, destroy their session. — waterloomatt, Aug 23 '19 at 11:51
– waterloomatt... How can i check? This is what i want that how can i check this and where i have to implement that code then in userLogin function or somewhere else? — Zain Shabir, Aug 23 '19 at 11:53
We can't tell you where to put that code because it depends on how you have your structure set up. However, it will need to be a place that every request can access. Do you have a helper class/script that is accessible on all pages? — waterloomatt, Aug 23 '19 at 11:55
I am calling Session User class file in all pages. Well in seperate file head.php and i am including this to all pages — Zain Shabir, Aug 23 '19 at 11:57
Perfect - Sachin's answer is a good start. Put that in your User class and then figure out how to call it on every request. — waterloomatt, Aug 23 '19 at 11:59
In addition, I know you're using `mysqli_real_escape_string`, but whenever we see variables being used directly in SQL statement like `...WHERE phone_number = '$phone_number'...`, the hair on the back of our collective necks stands up. You really should look into prepared statements. They're kind of an industry-standard now. — waterloomatt, Aug 23 '19 at 12:04

HujCio · Answer 1 · 2019-08-23T12:15:00.697

2

You need:

destroy_session();

or you need delete session variables:

unset($_SESSION);

and you can redirect to index page:

header('Location: index.php);
exit();

If session works on databases destroy session object.

$pdo = new PDO('mysql:host=localhost;dbname=produkty', 'root', 'root');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$stmt = $pdo->prepare('SELECT COUNT(*) as cnt FROM users WHERE user_id = :s1');
$stmt->execute( array( ':s1' => $userid ) );
$cnt = $stmt->fetchAll()[0]['cnt'];

if($cnt == 0){
    session_destroy();
    // destroy session here
}

edited Aug 23 '19 at 12:15

answered Aug 23 '19 at 11:46

HujCio

21
2

i know, but as i have write above in my question, let me tell you again. What checks will do this? How can i check if user account is deleted then session_destroy will work. – Zain Shabir Aug 23 '19 at 11:51
I have posted an answer, pls see and tell me if it ll resolve your problem or not. – Sachin Aug 23 '19 at 11:57
In this class Session::set("userlogin", true); you have got true if user was logged. Check in table is user account exists and then set to false or clear object and log out user. – HujCio Aug 23 '19 at 11:59
Dont use mysql_real_escape_string use prepared statment with PDO https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – HujCio Aug 23 '19 at 12:03

score 0 · Accepted Answer · answered Aug 23 '19 at 11:56

//call this function at top of every page after login

function checkexistuser(){

$user_id = $_SESSION['user_id'];

$query = "SELECT * FROM users WHERE user_id = '".$user_id."' ";
        $result = $this->db->select($query);
        if($result->num_rows() == 0){

            //destroy_session , redirect, show message whatever you want.
        }

}

Destroy session if user account is deleted from database but user is logged in

2 Answers2