Question

I have created a user page with a menu that contains a logout button. Upon clicking the button, the user is directed to a logout page with the following code:

session_start();
session_destroy();

include("/var/www/include/header.inc");
echo "<h>Logout Success</h>";
include("/var/www/include/menu.inc");
include("/var/www/include/footer.inc");

The code in the menu.inc file is written such that:

if(@$_SESSION['login'] == "yes")
{
 // show expanded menu
}
else
{
 // show normal menu
}

What I am seeing now after logging out is the expanded menu. It seems that the menu is being included faster than the session can be destroyed, thus creating an impression that the user is still logged in. Is there a way to avoid such a situation?

Answer 1

session_destroy doesn’t unset the $_SESSION array, so the rest of the page after session_destroy will still see it. You could simply try this

session_destroy(); 
unset($_SESSION);