Advice needed on Sessions

Hi!, I really need advice on this situation. I am at my first trial with sessions and need to understand how to destroy registered variables when a user does not complete a transaction that leads to the session_unregister() and session_destroy() functions. Context: Let say I have a program (script) "A" called from an HTML page that acts as a menu. Script "A" validates a password, re-enter itself with a form submit and continues, assuming a valid password, with further data entry and validation, and finally updates a database. All in the same script. A session is started at the beginning of the script "A". Once the user entered the valid password, it is session_register() so it will remain alive throughout the session. All other variables are passed through input fields of the form. The password registered variable is unregistered when the transaction concludes and the session is destroy there. Problem: Let say the user click the "back" button on the browser in the middle of the validation process after a valid password has been entered. Using "back" he gets back to the initial calling HTML page. Since he didn't go trough unregistered and destroy, the registered password variable is still active and contains the password (or something saying user is valid). If he calls again script "A" from there, the password validation is bypassed since the password is already valid. Question: What is the solution? Where can I find a good discussion on Sessions? Thank you. Claude Cormier