Login Problem-using session()

[rhodarose]

Good day!
I have an index.php or login page, when i login successfully and when i accidentally press the back button the login page appear, then when i try to login again, I could login again which is not correct, I have no idea how can i prevent to login again if the userr is zalready login.

here is my php code:

<?php  
session_start(); 
 if(isset($_SESSION['USER_ID'])){

exit("you can't login in again when your all ready logged!");
} 
$db_name="dspi"; 
mysql_connect("localhost", "root", "") or die("Cannot connect to server");
mysql_select_db("$db_name")or die("Cannot select DB");   


        $department = mysql_real_escape_string($_POST['department']);   
        $username = mysql_real_escape_string($_POST['username']); 

        $sql=mysql_query("SELECT `Department`, `Username` FROM `tbllogin` WHERE `Department` = '{$department}' AND Username = '{$username}'") or die(mysql_error()); 
        $ct = mysql_num_rows($sql); 
     
        if($ct == 1) { 
            $row = mysql_fetch_assoc($sql);  

$Departments=array('Accounting', 'Engineering', 'Finishinh_Goods', 'HRAD', 'MIS', 'Packaging_and_Design', 'Production', 'Purchasing_Logistic', 'QA_and_Technical', 'Supply_Chain');
  if(in_array($row['Department'], $Departments)){
       header('Location:Company.php');
  }else{
       header('Location:index.php');
       echo "Incorrect Username or Department";
      }
}
?>

[TheServant]

Well you see it's the browser that controls the back button, so it cannot be controlled by script/code. When you press back, the browser can either request that page again (probably what you would like), or display a cached version (which again you cannot stop). So what you want to look at is Website Cache Control.

Alternatively you can look at hiding or making it difficult to use the back button.

Ultimately as I say, the "back" functionality is a browser thing, not a code thing, so you do rely on the user's browser to behave, and the user to not mind you taking that control away from them... Two things you will never achieve 100%.

[rhodarose]

I have no idea how can prevent that the user can login again when they are already login

[malcolmk]

Playing with this sort of thing myself, what if you had a page index.php and all it doe's is check to see if session variable user id is set. if itis set then do nothing, if not set then include the page login.php which contains your code from above. If you see what I am getting at?

[malcolmk]

display form or not if logged in or not

Ok, been playing around with this and have something that works. May not be the best implementation but here goes, more experienced guys please feel free to point out and inappropriate code etc.

I start with a splash screen where the login form is displayed.

<?php session_start();?>
<html>
<head>
       <title>Title here!</title>
</head>
<body>
<h1>splash screen</h1>
blah blah...<br>
blah blah...<br>
blah blah...<br>
blah blah...<br>
<?php
if($session["logedin"]!="true")
{
	echo '<form action="login.php" method="post"';
	echo '<input type="text" name="user">username';
	echo '<input type="text" name="pass">password';
	echo'<input type="submit" value="submit">';
}
else { echo 'Already Logged In';}
?>
</body>
</html>

The splash calls the actual login check script.

<?php
session_start();
//error_reporting(-1);//remove this line if all is well
//ini_set('display_errors', true);// remove this line if all is well
$x= $_POST['user'];
$y= $_POST['pass'];
// make sure we got the values debug only
//echo 'user is '.$x.'   password is  '.$y;
//check user & password against database
// if ok then set $ok to true
$ok="true";// assume login is ok
if($ok=="true")
{	session_regenerate_id();// for security
	$session["logedin"]="true";
}
if($ok=="false"){session_destroy();}
// html or whatever or simply reload splash screen
include("splash.php");
?>

obviously the database check should deterine if $ok is set true or false but try changing it here manually to see that the script works on your server.
If you dont want the actual form on your splash screen it should be easy to replace the form with an active link to a login form on another page.