Sorry, coz i have a login page for the user to login and then will go into the main page, in the main page there is a logout button. the session id will be created in the main page and the checking will be in here too. when there press the logout button in the main page, the user will be redirect to the logout page and the sessionid will also be deleted. but although it seem to be like this way, but when i click the back button it still can go back to the main page, although i had include the checking for the valid sessionid. it seem that the back button is capturing the html script(when u use the view source can see the html script) when u click the back button rather than refresh the who page by loading the cgi script. so what should i do since i also included the expiry, no cache in the query header part.