I was having a problem clearing all session variables, deleting the session, and creating a new session without leaving old session stuff behind in all browsers. The below code is perfect for a logout script to totally delete everything and start new. It even works in Chrome which seems to not work as other browsers when trying do logout and start a new session.
<?php
session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);
?>
session_unset
(PHP 4, PHP 5, PHP 7, PHP 8)
session_unset — Удалить все переменные сессии
Описание
session_unset(): bool
Функция session_unset() удаляет все зарегистрированные переменные текущей сессии.
Список параметров
У этой функции нет параметров.
Возвращаемые значения
Возвращает true в случае успешного выполнения или false в случае возникновения ошибки.
Список изменений
| Версия | Описание |
|---|---|
| 7.2.0 | Теперь возвращаемый тип этой функции bool. Раньше был тип void. |
Примечания
Замечание:
При использовании $_SESSION для удаления переменных сессии, то используйте функцию unset(). Например,
unset($_SESSION['varname']);.
Предостережение
НЕ удаляйте весь массив $_SESSION с помощью
unset($_SESSION), так как это приведёт к невозможности
регистрации новых переменных через суперглобальный массив
$_SESSION
Замечание:
Использование функции session_unset() идентично
$_SESSION = [].
Предостережение
Функция работает только в том случае, если сессия активна. Она не очистит массив $_SESSION,
если сессия ещё не запущена или уже уничтожена. Используйте $_SESSION = [] для удаления всех переменных сессии,
даже если сессия не активна.
add a note
User Contributed Notes 4 notes
tim at leethost dot com ¶
12 years ago
jerry ¶
9 years ago
The difference between both session_unset and session_destroy is as follows:
session_unset just clears out the session for usage. The session is still on the users computer. Note that by using session_unset, the variable still exists. session_unset just remove all session variables. it does not destroy the session....so the session would still be active.
Using session_unset in tandem with session_destroy however, is a much more effective means of actually clearing out data. As stated in the example above, this works very well, cross browser. session_destroy is destroy the session. session_destroy() to kill all session information.....This is the more secure function to use.
Jeroen ¶
19 years ago
note to Jason: I don't know the exact mechanics of it (since I'm quite new to sessions) but I think you need to use session_unset() BEFORE you can use session_destroy() at all. I thought that session_unset() was for scripted variables, and session_destroy() just for anything saved on your side regarding the session.
zach at zkwarta dot com ¶
19 years ago
The difference between both session_unset and session_destroy is as follows:
session_unset just clears out the sesison for usage. The session is still on the users computer. Note that by using session_unset, the variable still exists.
Using session_unset in tandem with session_destroy however, is a much more effective means of actually clearing out data. As stated in the example above, this works very well, cross browser:
session_unset();
session_destroy();
I noticed that in firefox, one could simply use sesison_unset and the session would be cleared. When trying this on IE, I was horrified to find out that the data was still there, so I had to use session destroy.
