I was having a problem clearing all session variables, deleting the session, and creating a new session without leaving old session stuff behind in all browsers. The below code is perfect for a logout script to totally delete everything and start new. It even works in Chrome which seems to not work as other browsers when trying do logout and start a new session.
<?php
session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);
?>
session_unset
(PHP 4, PHP 5, PHP 7, PHP 8)
session_unset — Détruit toutes les variables d'une session
Description
session_unset(): bool
session_unset() détruit toutes les variables de la session courante.
Liste de paramètres
Cette fonction ne contient aucun paramètre.
Valeurs de retour
Cette fonction retourne true en cas de succès ou false si une erreur survient.
Historique
| Version | Description |
|---|---|
| 7.2.0 | Le type de retour de cette fonction est désormais booléen. Auparavant, c'était void. |
Notes
Note:
Si vous utilisez $_SESSION utilisez unset() pour détruire une variable de session, i.e.
unset($_SESSION['nomvariable']);.
Attention
Ne détruisez pas $_SESSION avec
unset($_SESSION) car cela désactivera
la possibilité d'enregistrer des variables de session à partir du
tableau superglobal $_SESSION.
Note:
Utilisez seulement session_unset() pour du vieux code obsolète qui n'utilise pas $_SESSION.
AttentionCette fonction ne fonctionne que si une session est active. Elle ne videra pas le tableau $_SESSION si la session n'a pas encore été démarrée ou si elle a déjà été détruite. Utilisez
$_SESSION = []pour supprimer toutes les variables de session même si la session n'est pas active.
add a note
User Contributed Notes 4 notes
tim at leethost dot com ¶
12 years ago
jerry ¶
9 years ago
The difference between both session_unset and session_destroy is as follows:
session_unset just clears out the session for usage. The session is still on the users computer. Note that by using session_unset, the variable still exists. session_unset just remove all session variables. it does not destroy the session....so the session would still be active.
Using session_unset in tandem with session_destroy however, is a much more effective means of actually clearing out data. As stated in the example above, this works very well, cross browser. session_destroy is destroy the session. session_destroy() to kill all session information.....This is the more secure function to use.
Jeroen ¶
19 years ago
note to Jason: I don't know the exact mechanics of it (since I'm quite new to sessions) but I think you need to use session_unset() BEFORE you can use session_destroy() at all. I thought that session_unset() was for scripted variables, and session_destroy() just for anything saved on your side regarding the session.
zach at zkwarta dot com ¶
19 years ago
The difference between both session_unset and session_destroy is as follows:
session_unset just clears out the sesison for usage. The session is still on the users computer. Note that by using session_unset, the variable still exists.
Using session_unset in tandem with session_destroy however, is a much more effective means of actually clearing out data. As stated in the example above, this works very well, cross browser:
session_unset();
session_destroy();
I noticed that in firefox, one could simply use sesison_unset and the session would be cleared. When trying this on IE, I was horrified to find out that the data was still there, so I had to use session destroy.
