Security in websites, part deux....

alright, so, i finally got around to designing my 'security system' for my family's website. here's how it'll work:

user enters their username and password into an html form. a javascript function will confirm that both are between 6 and 16 characters long
if they, are, they'll be passed to login.php which will double check the lenghts of the two strings, and then confirm that neither one contains anything but letters and numbers. if they don't pass muster, the user gets rerouted to the html login form.
if the above two criteria evaluate to true, then a SQL query will run to see if there's a matching username and password row in a database.
IF SO, the script calls session_start() and $_SESSION['UsrIsLogdIn']=true;. the script then redirects them to the rest of the site.

if ($_SESSION['UsrIsLogdIn']!==true) {
header("Location:index.php");
exit();
}

[Edit: oh, and what do you think is the best way to handle the user logging out? just setting $_SESSION['UsrIsLogdIn'] to false?]