6

I've been reading the manual and various pages on the web including lot's of questions here on SO. However, I've still not been able to get my head around the concept of session_destroy() in PHP in conjunction with other means of unsetting session data.

Consider this for a site that never registers session variables outside the $_SESSION superglobal array.

session_start();
$_SESSION = array();
session_regenerate_id(true); // New cookie + old session file on server deleted
session_destroy();  // What does PHP do here that was not done above?

Please note that I have built working login-logout scripts for years. This question is not about getting things to work, but I want to understand exactly what is happening.

(A lot of answers here on SO also use session_unset() which unsets registered variables. However, I never use session_register(), so that seems really redundant.)

6
  • well, you've just deleted your new session server file, as well as the old one. I assume it will simply be re-created when you set a session value, or at the end of the script, or when whatever optimisation PHP does says it's time to save data.
    – Dave
    Aug 15, 2013 at 22:43
  • (odds are that PHP never actually created that file in the first place; I hope it would wait until there is actual data to put in it)
    – Dave
    Aug 15, 2013 at 22:44
  • As is explained in the accepted answer, session_regenerate_id(true) calls the same underlying function as session_destroy, making that extra line redundant in my case.
    – itpastorn
    Aug 16, 2013 at 11:02
  • 1
    I don't think you get it still, session_regenerate_id(true) is equivalent to session_destroy() followed by session_start() except that you retain the previous session data.
    – Ja͢ck
    Aug 16, 2013 at 12:55
  • If you look at the code in the example I have set $_SESSION to an empty array. Thus, there is no session data to retain. But since there is a session still in place I can of course populate the array with new data without having to call session_start first.
    – itpastorn
    Aug 17, 2013 at 20:38

2 Answers 2

5

The session_regenerate_id() function is meant to copy or move the session data based on its corresponding identifier; it's typically used when a user logs in to prevent session fixation. Afterwards, the session is still active and it can be accessed with $_SESSION.

The session_destroy() removes the current session data. Afterwards, the session is gone and you can only start a new session using session_start().

If a user signs out of your site, the most appropriate action is to destroy the session altogether; i.e. use session_destroy().

Btw, session_register() and session_unset() are deprecated and shouldn't be used.

4

Let's go to the source. Literally.

session_destroy() and session_regenerate_id() are both implemented in ext/session/session.c in the PHP source. It's obvious from a quick reading that if you pass true to session_regenerate_id, it calls s_destroy on the underlying session save handler, which is the exact same call as the one made by session_destroy. This behaviour has remained the same since at least 2005, according to an svn blame.

session_destroy does make two additional calls to php_rshutdown_session_globals and php_rinit_session_globals. Among other things, this causes session_destroy() to call the close function in the save handler, but this is done automatically when the request has completed, anyway (see PHP_RSHUTDOWN_FUNCTION). It also resets the session to the inactive state (like before calling session_start), which can be seen by calling session_status() (introduced in php 5.4).

The take away from all of this is that you never have to call session_destroy before calling session_regenerate_id(true). However, if you want to reset the session, you still have to call it after, because otherwise the session will still be active, and the current contents of $_SESSION will be written to storage by the save handler when the request has finished.

1
  • 1
    Thank you! That also means that for a script that does not use any global session variables - as in my question - and that explicitly sets $_SESSION to an empty array, session_destroy does not bring any additional benefits!
    – itpastorn
    Aug 16, 2013 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.