Broken PHP page security -

i have @ top of navigation file included on every single page:

if (!is_logged_in()){         login_error_redirect(); } 

here's function:

function is_logged_in(){     if(isset($_session['gbuser']) && $_session['gbuser'] > 0){         return true;     }         return false; } 

now works insomuch if try browse protected page redirected login page, reason doesn't apply if supply request, allows bypass whole thing. instance, having logged out (which calls session_destroy();), can enter following address , item gets deleted:

../site/products.php?delete=20 

what missing here? products page includes same navigation file security check above, passing in variable skips reason.

edit: here's top of products.php:

require_once $_server['document_root'].'/shopping/core/init.php'; include 'includes/head.php'; include 'includes/navigation.php';  //if delete product button clicked if(isset($_get['delete'])){     $delete_id = (int)($_get['delete']);     $db->query("update products set deleted = 1 id = '$delete_id'");     header('location: products.php'); } 

and @ top of navigation.php check:

if (!is_logged_in()){         login_error_redirect(); } 

assuming login_error_redirect() redirects, have add exit stop script after function called. default, php run code on page regardless if redirect @ top.

if (!is_logged_in()){         login_error_redirect();         exit; }