Ususally, when I'm done with a session, I'll do an "<META EQUIV='REFRESH' ....> to another page after I issue a session_destroy just to make sure that I've elimianated any stored session info, but regardless the best way is to literally close out the browser. Give it a try, though.