I use both of Taco's suggested approaches for my multiplayer games. In my experience, the onUnload event or onBeforeUnload return function is only moderately effective, depending on the browser. It obviously doesn't work if someone is simply disconnected. It also doesn't work on quitting, killing the browser process, or closing a tab if it isn't the active tab in FF. It's a nice way to let the server clean up if possible, but it's by no means a panacea.

Typically what I do in addition to that is to issue a new hash upon login. I keep a users_sessions db table that records userID, hash and most recent ping time. When the player logs in again, the hash is changed. Then I have Flash player ping the server every so often with the user's ID and the hash it received when it started up. (There's no reason you couldn't make this repeating call with AJAX if you wanted to). On every ping, the server compares the hash sent and updates the most recent ping time. If the hash doesn't match, the client is logged out. I then use a mark-and-sweep technique to flag users whose most recent ping was >N seconds ago, set them disconnected, perform the necessary game logic and flush them from the active database.