Question

How do I implement a user-kick function for administrators of an web-application?

Answer 1

I'm working on a web-application, where users can log-in. I used php sessions for that. So the web-application has also an administator-area where the admin should be able to log out users, who are currently logged in. That means, i have to destroy their session, is that correct? Do I need their session-id or is there another way?

Answer 2

Generally if the user is register you will get some details from him.
This would be the IP address and the personal details.

You could simply get a file with blacklisted IPs and create a function that die()s if the IP is on the list. On the administation area you would have a simple input for username or IP address.

Sorry misunderstood, however following you now you could simply insert the current session on the db providing protection against multiple logins.(If session id != last session id: destroy session) and to kick someone you just change the session id in your db to null and when they login it will change back to the curent session id.

Answer 3

Hope it helps :)

Answer 4

sorry i'm very new to php. but i thought that it is NOT possible to get all the session ids from the logged in users. what do you mean with insert current session in database?
besides my userdata-table I have already a table which contains the email-adresses of those users which are logged in. how can i get their session_ids as well?

Answer 5

http://php.net/manual/en/function.session-id.php
Get it when they log in and whenever a page loads check the current id with that one registered in the db.

To kick them simply null the value in the db and they should be able to login again.

Answer 6

I agree with fabianhjr.. you need to check the DB if the session is alive or not.. while Admin can check the DB list and delete who ever s/he want to kick.