title: PHP Remote Force Logout
body: <p>I'm currently using PHP sessions to keep track of user sessions, with a <code>last-activity</code> field for timeouts, an <code>id</code> field, and an <code>account-type</code> field. Currently, all of this information, as well as settings data, is pulled form a MySQL database and stored in the session once the user is logged in, and remains unchanged for the duration of the session.</p>
  
  <p>The issue is that I wish to implement the ability for administrators to change users' account types remotely. If the user's account type is changed remotely while they're still logged in, the change in the database won't be reflected in the user's session variable.</p>
  
  <p>One solution to this would be to add a <code>logout_flag</code> column to the <code>users</code> database table. When a user's account type is changed by an administrator, that user's entry in the database will have <code>logout_flag</code> set to <code>1</code>. Then I can use a session script to check this entry on every page load, and log them out if it's set to <code>1</code>.</p>
  
  <p>My concern is that this would add too much overhead for the server; With hundreds of users logged in at the same time, this would amount to hundreds of MySQL queries per minute. Is this the ideal solution though?</p>