Question

I’m unlogging users with this code:

<?
   session_start();
   session_destroy();
?>

However doing it leaves a PHPSESSID cookie in the browser. What is this? Is there a way to make sure there are no traces of it at all?

I also tried:

session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);

Answer 1

Calling session_unset() before using session_name() in your clearing call to setcookie() is likely to be the problem. It removes all your session variables, leaving your setcookie call to operate on the wrong, or no, cookie.