E-Commerce site problems

[davids_media]

I am relatively new to php but I have been learning since the end of 2011.

 

At the moment, I am currently developing an E-Commerce website for a customer, using the Larry Ullman book "Effortless E-Commerce' as a guide.

 

I am hitting many brick walls at the moment though.

 

But before I state my long winded problem, I have attached all my work done thus far to this message.

 

HERES THE PROBLEM...

 

I have created a series of includes such as config.inc.php, form_functions.inc.php, login.inc.php and login_form.inc.php.

 

They are included/required with most of my other files.

 

However I have some major issues;

 

1. This is the code for my logout.php file;

<?php

require ('./includes/config.inc.php');

// If the user isn't logged in, redirect them:
redirect_invalid_user();

// Destroy the session:
$_SESSION = array(); // Destroy the variables.
session_destroy(); // Destroy the session itself.
setcookie (session_name(), '', time()-300); // Destroy the cookie.

// Include the header file:
$page_title = 'Logout';
include ('includes/header.html');

// Print a customized message:
include ('includes/main.html');
echo '<h3>Logged Out</h3><p>Thank you for visiting. You are now logged out. Please come back 

soon!</p>';

// Footer file needs the database connection:
require (MYSQL);

// Include the HTML footer:
include ('includes/footer.html');
?>

 

At the moment, I cannot determine if a user is logged in/when they logout, I cannot determine if there is an active session and also, when I log into the site, I have a database with values yet it seems to let any Tom, Dick and Harry onto the site to log in even though they are not stored in the database.

 

I apologise if this sounds confusing but I really need some major league help.

 

Help would be greatly appreciated

17884_.zip

[cpd]

After running your logout page the $_SESSION variable will no longer be accessible because you've run the session_destroy() function. In order to access your $_SESSION variable again you must run the session_start() function once more.

 

You can also use isset() to ensure your code functions even when session_destroy() hasn't been called. You've probably done a similar thing with your redirect.

 

if(isset(SESSION[loggedin]) && SESSION[loggedin]) // Code