I have the following structure:

```
Index.php
Account.php
Login.php
CheckLogin.php

```

When someone logs in via login.php it checks the username and password and sets the following session variables

```
$_SESSION['username'] = $username;
$_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);

```

When they access Account.php
that includes the file CheckLogin.php which checks the HTTP\_USER\_AGENT and also if the username variable is set.

Now here's where I have the problem. If a user went back to index.php (home page) and is logged in I would like to display the account link.
However if the user is not logged in i.e. just visited the site I would like to show the sign up link.
I was thinking I could do the following:

```
<?php session_start()

if (!isset($_SESSION['username'])) {
// If username is not set destroy the session
session_destroy();
echo ("<a href=\"signup.php\">Sign up</a>");
}
else {
// If username is set
echo ("<a href=\"account.php\">Sign up</a>");
}
?>

```

I know this is not fully secure however if someone managed to hijack the session and went to account.php it would do the check which should destroy the session and log them out if they are not legit.
Is this best practice or is there a better way to achieve this desired result. I can't help thinking everyone just visiting the site and creating and destroying sessions is a bad idea. Is it the right thing to do or is there anything else I need to take into consideration?