Hi there,
Since we're using the same database, The solution for this will be like the below:
1- When the user log in, save his session data in the database using his unique user ID and the time of login.
2- The database will have a column that will keep track of user activity, basically updating the time of activity for every page refresh.
3- When every page get refreshed, the script will check the last time of activity, if it's more than 5 minutes, then log that user out.
4- Also for every refresh will check if he has a different ip address than the first session imitated and if he does then log him out as well
I created something similar to this before so I know what I'm doing here, please don't hesitate to get in touch to discuss further details.
Regards,
Amr