want to ensure that I have killed a session and immediately start a new one

schwim

Hi there,

I want to destroy a session and ensure that I've eradicated any values being stored, then immediately start a new session:

the values:

$SESSION['value1']
$SESSION['value2']

session_destroy();
?
session_start();

in between destroy & start, do I need to clear the two values? If so, do I use

unset $_SESSION['value1']

unset $value1

as the php manual is a little confusing about this.

thanks very much for your time.

thanks,
json

NogDog

I think this would work, but I haven't tested it.

<?php
// destroy a session:
session_start();
$_SESSION = array(); // clear all session data in memory
if (isset($_COOKIE[session_name()])) {  // clear session cookie
    setcookie(session_name(), '', time()-42000, '/');
}
session_destroy();  // clear all session data on disk
session_regenerate_id();  // start new session

jkurrle

I think you should do a session_unset() before the session_destroy(). I read somewhere that on rare occasions session variables can be read otherwise.

NogDog

jkurrle wrote:
I think you should do a session_unset() before the session_destroy(). I read somewhere that on rare occasions session variables can be read otherwise.

I believe that session_unset() and $_SESSION=array() should be functionally equivalent. It probably won't hurt to do both, but most likely it's redundant.