PHP won't change what to import when logged in

Question

When you click login, it should then display the logout button. Clicking the logout button should make it display the login options again. Currently it just keeps sitting on the login window even though it creates a session and fills it with the right information in my server.

I am not sure why my code is not working. I had it working, then it suddenly stopped and I am not sure what I changed. Also, I am aware that this is not using a database and that I should be using one, but the assignment calls to not use one.

Here is index.php:

<?php

    session_start();
    if(empty($_SESSION['email']))
    {
        include("includes/login.php");
    }
    else 
    {
        include("includes/logout.php");
    }

?>

Here is my login.php:

<form id="login" method="post" action="index.php">
    <input name="email" type="email" placeholder="[email protected]" required="required">
    <input name="password" type="password" placeholder="Password" required="required">
    <input class="button" name="submit" type="submit" value="Submit">
</form>

<?php
    //if someone tries to log in
    if (isset($_POST['email']) && isset($_POST['password']))
    {
        $email=($_POST['email']);
        $password=sha1($_POST['password']);

        $users = file('includes/users.php', FILE_IGNORE_NEW_LINES);

        for($i=0;$i<count($users);$i++)
        {
            $user = explode(',', $users[$i]);
            if($user[0] === $email && $user[1] === $password)
            {
                session_start();
                $_SESSION['email']=$user[0];
                $_SESSION['pass']=$user[1];
                $_SESSION['name']="$user[2] $user[3]";
                $_SESSION['admon']=$user[4];
            }
        }
    }   
?>

Here is logout.php:

<form id="login" method="post" action="index.php">
    <input name="logout" type="submit" value="logout" />
</form>

<?php
    if($_POST['logout'] === 'logout')
    {
        session_destroy();
    }
?>

Answer 1

In your index.php, you check if the user has already logged in:

if(empty($_SESSION['email']))

If not, you include the login page, otherwise the logout. But if you just submitted your form, SESSION['email'] is still empty, and you are displaying your form. But you have your login data, so if your details are correct, you will be logged in - and you will see it after a refresh.

Same is true for your logout - if you submit your logout form, your session will be active for one last request (which destroys it), so the logout page will be seen again. You need to refresh your browser, and the login will appaer.

To fix both problems, simly add a redirect to the end of both if-s. E.g.:

if($_POST['logout'] === 'logout')
{
    session_destroy();
    header('Location: index.php);
}

This will reload your page after processing the logout, effectively giving you the good result. Do the same to the login, and it will work too.