Edit Report a Bug

    session_destroy

    (PHP 4, PHP 5, PHP 7, PHP 8)

    session_destroy — Destroys all data registered to a session

    Description

    session_destroy(): bool

    session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. To use the session variables again, session_start() has to be called.

    Note: You do not have to call session_destroy() from usual code. Cleanup $_SESSION array rather than destroying session data.

    In order to kill the session altogether, the session ID must also be unset. If a cookie is used to propagate the session ID (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

    When session.use_strict_mode is enabled. You do not have to remove obsolete session ID cookie because session module will not accept session ID cookie when there is no data associated to the session ID and set new session ID cookie. Enabling session.use_strict_mode is recommended for all sites.

    Warning

    Immediate session deletion may cause unwanted results. When there is concurrent requests, other connections may see sudden session data loss. e.g. Requests from JavaScript and/or requests from URL links.

    Although current session module does not accept empty session ID cookie, but immediate session deletion may result in empty session ID cookie due to client(browser) side race condition. This will result that the client creates many session ID needlessly.

    To avoid these, you must set deletion time-stamp to $_SESSION and reject access while later. Or make sure your application does not have concurrent requests. This applies to session_regenerate_id() also.

    Parameters

    This function has no parameters.

    Return Values

    Returns true on success or false on failure.

    Examples

    Example #1 Destroying a session with $_SESSION

    <?php
    // Initialize the session.
    // If you are using session_name("something"), don't forget it now!
    session_start();

    // Unset all of the session variables.
    $_SESSION = array();

    // If it's desired to kill the session, also delete the session cookie.
    // Note: This will destroy the session, and not just the session data!
    if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
    $params["path"], $params["domain"],
    $params["secure"], $params["httponly"]
    );
    }

    // Finally, destroy the session.
    session_destroy();
    ?>

    See Also

    add a note add a note

    User Contributed Notes 4 notes

    up
    51
    Praveen V
    12 years ago
    If you want to change the session id on each log in, make sure to use session_regenerate_id(true) during the log in process.

    <?php
    session_start    ();
    session_regenerate_id(true);
    ?>

    [Edited by moderator (googleguy at php dot net)]
    up
    26
    Jack Luo
    10 years ago
    It took me a while to figure out how to destroy a particular session in php. Note I'm not sure if solution provided below is perfect but it seems work for me. Please feel free to post any easier way to destroy a particular session. Because it's quite useful for functionality of force an user offline.

    1. If you're using db or memcached to manage session, you can always delete that session entry directly from db or memcached.

    2. Using generic php session methods to delete a particular session(by session id).

    <?php
    $session_id_to_destroy     = 'nill2if998vhplq9f3pj08vjb1';
    // 1. commit session if it's started.
    if (session_id()) {
            session_commit();
    }

    // 2. store current session id
    session_start();
    $current_session_id = session_id();
    session_commit();

    // 3. hijack then destroy session specified.
    session_id($session_id_to_destroy);
    session_start();
    session_destroy();
    session_commit();

    // 4. restore current session id. If don't restore it, your current session will refer to the session you just destroyed!
    session_id($current_session_id);
    session_start();
    session_commit();

    ?>
    up
    -31
    JBH
    7 years ago
    I'm using PHP 7.1 and received the following warning when implementing Example #1, above:

        PHP message: PHP Warning:  session_destroy(): Trying to destroy uninitialized session in...

    What I discovered is that clearing $_SESSION and removing the cookie destroys the session, hence the warning.  To avoid the warning while still keeping the value of using session_destroy(), do this after everything else:

        if (session_status() == PHP_SESSION_ACTIVE) { session_destroy(); }
    up
    -22
    greald at gmail dot com
    3 years ago
    All of a sudden neither session_destroy() nor $_SESSION=[] were sufficient to log out. I found the next to work:
    <?php
    setcookie    (session_name(), session_id(), 1); // to expire the session
    $_SESSION = [];
    ?>
    add a note add a note
    To Top