Question

session_start();
$_SESSION['user'] = "789456";
$_SESSION['name'] = "dummy";
$_SESSION['id'] = "123";
print_r($_SESSION);
session_destroy();
echo "Session End";
print_r($_SESSION);

My output is:

Array ( [user] => 789456 [name] => dummy [id] => 123)
Session End :Array ( [user] => 789456 [name] => dummy [id] => 123) 

Shouldn’t the output just be:

Array ( [user] => 789456 [name] => dummy [id] => 123)

If I use session_unset() before session_destroy() then I get the result I expect. Is it always necessary to use session_unset() before session_destroy()?

Answer 1

From the documentation:

session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. To use the session variables again, session_start() has to be called.

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

The easiest way would be: $_SESSION = array(); after calling session_destroy();.