getting rid of a session

[jpmoriarty]

i use sessions on an online ordering site that i've made. however, i want to be able to stop people going back and altering things after they reach the end, since some of my queries use the session number thingy.

I tried using session_destroy(), but it doesnt appear to do anything. Is there a way of stopping an old session and starting a new one without closing the browser window? Or am i on the right track but just missing something??!!

Many thanks

[mogster]

If you create a replica of the session in db, you may delete it on logout. And if the script depends on expecting both, it would execute a different code when only one present.

But it would require some no-cache statements in headers, perhaps?
Like:
header("Cache-Control: no-cache, must-revalidate");
header("Pragma: no-cache");

knutm

[Tracer]

post you sessiondestroy code..... I had the same problem and fixed it....Turns out you have to START a session before you can destroy it!

This worked for me...make sure it is the first line of your php file...

<?
session_start();
session_unregister(YOURVARS);
session_destroy();
$_SESSION=array();
?>

[jpmoriarty]

does the destroy have to be at the start too? Because there's code i want to run on the page before i destroy the session.

Also, i'm not too sure i quite get the session_start thing - all i'm using in my sessions is the session id to keep track on the user. on some pages i have session_start, and some i forgot to put it on, but it still works fine throughout. Is that just a quirk? Am i better off to put a session_start at the top of all my pages that use my sessions? And what's the point of starting a session (supposedly to help keep track of my users) if i then have to restart it every page thereafter??!!

Many thanks for the advice in the interim though...

[jpmoriarty]

okay now i'm totally baffled.

First I thought i'd get around it all by calling up the reservations page into a new window: i thought that that would mean that each time you clicked on the button, you got a new session id, problem solved. But no, you close the window when you've finished ordering, you can click on the "reserve tickets" button again, a new window opens up, and it's got the same session id as the one that just got closed!

So then i thought i'd do it so that when you clicked on the "reserve tickets" button, it ran a php called "session_destroy.php" which contained:

<?php
     session_start();
     session_unregister();
     session_destroy();
     $_SESSION=array();
     header("Location:orderframes.php");
?>

(remember now all i'm using is the session id, nothing else).

but still no - somehow it manages to pull up the orderframes file (and the two php files that go into those frames) with the same session id as before.

What's going on! is it something to do with the name that i've given my target frame? (i'm calling it into target="tickets", which doesnt exist, so i'm getting a new window created. actually, if i used javascript to open the new window, might that work?... i'll give it a go but would still appreciate comments!)

[Tracer]

If you have no session variables set get rid of the session_unset();........

I had this same exact problem.....

I used javascript to redirect the browser to a new page which had only the previously posted code, and another JS to redirect it back to the homepage.

It worked for me.....

And yes...you must call session_start() before you can call session_destroy()

[jpmoriarty]

yeah the javascript one isnt working either. it still uses the same session as the last window that was opened. i'll get rid of the session_unset too, but since i didnt have any variables i cant imageine that it will actually make any difference, will it?

what am i missing here??!! thanks for the advice so far though.

[Tracer]

I have a PHP script which starts a session, allows users to scan multiple items with a scanner, captures a digital signature from a tablet, saves the entire transaction to a MySQL backend, then clears the session for the next customer (the browser window is never closed.

here is the code I use to destroy the session:

<?
session_start();
session_unregister(rxs);
session_unregister(profile);
session_unregister(inque);
session_unregister(signature);
session_unregister(totalcopay);
session_destroy();
$_SESSION=array();
?>

<?
unset($rxs);
unset($profile);
unset($inque);
unset($signature);
unset($totalcopay);
?>

<SCRIPT LANGUAGE="JavaScript">
<!-- Begin
window.location="beginscan.php";
// End -->
</script>
</HEAD>
</HTML>