I'll leave the first three points to Philo, or until I have more time, but the session timeout is relatively simple.

You just need to set a timestamp into a session variable when the user logs in. Any time the user visits a page when logged in, even ones that don't require a login you check the timestamp.

If it was set less than two hours in the past then you update it to the current time, otherwise you remove it.

If you do this before any login check then you can simply check for the existence of the timestamp when checking for a login.

Sample code is here, let me know if you have any issues with it.

Browser: Mozilla Firefox 3.6.*

OS: Windows 7

Okay, I got some time this evening, and I went over the other few problems. I found some more along the way.

First create a folder called 'css' and one called 'js'. The .css file goes into the css folder, and the .js file goes in the js folder. This will fix the question-mark helpers on the register.php page.

As for the rest, make the following changes:

To fix the activation link 404 change register.php line 76. "http://localhost/login/activate.php" changes to "activate.php"
This will need to be replaced with a full url if you want it to work via email.

In activate.php change "if ($id&&$code) {" to "if (isset($id,$code)) {" because, for me at least, this failed when id=0.

To give access to the members area (and other member pages) on login.php change line 27 "$_SESSION['username']==$dbusername;" to "$_SESSION['username']=$dbusername;"
The == checks if a condition is true, while = sets a variable.

To allow successful changing of passwords in changepassword.php change line 22 "WHERE='$user'" to "WHERE username='$user'"
The column to check was missing.

Browser: Mozilla Firefox 3.6.*

OS: Windows 7

thanks ile try it out

Browser: IE 7

thanks everything is now working except that when i click the activation link to activate the new account it says data missing also it isnt suppose to let you use the same username and password but it does

please tell me how to fix these last 2 problems and then the php login logout register change password and activate account system will be perfect in my eyes

Browser: IE 7

It lets you use the same password again, but the username must be unique. Check that you're using the code linked to by Philo Kvetch and that the username query (around line 26 or 27) in register.php uses $username rather than &username.

The activation link must contain an id and a code parameter. The link sent by register.php should look something like "activate.php?id=4&code=25552321". If not, find where the link is output from register.php (line 76 on my copy) and make sure the line reads: echo "<a href='activate.php?id=$lastid&code=$random'> activate.php?id=$lastid&code=$random </a> </p>";

Browser: Mozilla Firefox 3.6.*

OS: Windows 7

thanks now its finally complete maybe ile actualy use it when ever i feel like getting pro hosting

Browser: IE 7

There's a site (000webhost.com) that offers free web hosting with php.

Browser: Mozilla Firefox 3.6.*

OS: Windows 7