If you are using session variables then the user is online if last_activity + session_expiry > current_date. Else the session has already expired and they are not online.
Now, it depends on what people will be able to do with this "who is online" feature. You might prefer a more conservative measure to have a higher confidence the user's active.
But, given the nature of the web, there's no sure fire way to ensure the user's really online and active in your site, short of requiring user interaction every once in a while, but that would be annoying.