I've been reading the manual and various pages on the web including lot's of questions here on SO. However, I've still not been able to get my head around the concept of session_destroy()
in PHP in conjunction with other means of unsetting session data.
Consider this for a site that never registers session variables outside the $_SESSION
superglobal array.
session_start();
$_SESSION = array();
session_regenerate_id(true); // New cookie + old session file on server deleted
session_destroy(); // What does PHP do here that was not done above?
Please note that I have built working login-logout scripts for years. This question is not about getting things to work, but I want to understand exactly what is happening.
(A lot of answers here on SO also use session_unset()
which unsets registered variables. However, I never use session_register()
, so that seems really redundant.)
session_regenerate_id(true)
is equivalent tosession_destroy()
followed bysession_start()
except that you retain the previous session data.$_SESSION
to an empty array. Thus, there is no session data to retain. But since there is a session still in place I can of course populate the array with new data without having to callsession_start
first.