title: Destroying session for user login / NULL $_SESSION remnant
body: <p>I'm trying to create a user login system for use on a website I'm building. I have the login script and register script, but I'm having trouble with the logout and destroying the sessions. </p>
  
  <p>Here's my index code. It gets the database info in config (doesn't do anything with it yet), then runs check-login to make sure the user is actually logged in. It has a logout button that routes to logout.php</p>
  
  <pre><code>&lt;?php 
      include_once("config.php");
      include_once("check-login.php");
      session_start();
      $username = $_SESSION["username"];
  ?&gt;
  
  &lt;html&gt;
  &lt;body&gt;
      &lt;h1&gt;
          Hello &lt;? echo $username ?&gt;! We're still building, but feel free to... wait?
      &lt;/h1&gt;
      &lt;form action="logout.php"&gt;
          &lt;input class="logoutbutton" type="submit" value="Logout" /&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Here is my check-login.php file. Notice that anytime I link back to the index, I'm using a <code>$_GET</code> to post some information into the address bar. There is no place where I simply go back to <code>index.php</code></p>
  
  <pre><code>&lt;?php
      ob_start();
      include_once("../myreadingplanner_config/config.php");
  
      if(($_SESSION['username']) != null){ //If user is already logged in...
          $username=$_SESSION['username'];
          header("Location: index.php?Message=AlreadyLoggedIn$username");
      } 
      else {
  
          if(isset($_POST['username']) &amp;&amp; strlen($_POST['username'])!=0){ //if username is valid
              $username = $_POST['username'];
          } else {
              header('Location: login.php');
          }
  
          if(isset($_POST['password']) &amp;&amp; strlen($_POST['password'])!=0){
              $password = $_POST['password'];
          } else {
              header('Location: login.php');
          }
  
          $SQLString = "SELECT TOP(1) * FROM Users WHERE Username = '$username' AND Password = '$password'";
          $result = sqlsrv_query($conn, $SQLString) or die ("");
  
          if($result != null)
          {   
              $_SESSION['username'] = $username;
              header("Location: index.php?Message=YouLoggedIn$username");
          } else {
              header("Location: index.php?Message=UserLoginNotFound&amp;Username=$username");
      }
  }
  ob_flush();
  ?&gt;
  </code></pre>
  
  <p>And finally here is my logout.php, which should (in theory) destroy the session, and head back to index.php. When it gets back to index.php, index.php will reroute to login.php using the <code>include_once("check-login.php");</code> </p>
  
  <pre><code>&lt;?php
      session_start();
      session_destroy();
      header('Location: index.php');
  ?&gt;
  </code></pre>
  
  <p>Just looking at my logic, there SHOULD be an infinite loop in the check-login, right? Because if the user is logged in, it should reroute to index, which includes check-login, which reroutes to index, which... etc.</p>
  
  <p>If you want to check out the site for yourself, please go to www.myreadingplanner.com, and use this info to login (user will be deleted eventually)</p>
  
  <pre><code>Username: StackUser
  Password: password1
  </code></pre>
  
  <p>So functionality wise, login.php should NEVER be visible unless you have a valid session, and when it does, it should say 'Welcome $username!'. But if you hit the logout button on index, it will still keep the session open, but it will be null.</p>
  
  <p>Any advice on either why logout doesn't seem to fully logout the user OR why it is logging the user out but is keeping the NULL $_SESSION around?</p>