Do you need to use session_unset before session_destroy?

According to w3schools (https://www.w3schools.com/php/php_sessions.asp) to remove a session (log out) you should do it this way:

session_unset(); 
session_destroy();

But I don't understand why you'd have to unset all session variables first, wouldn't just session_destroy be enough?


You can find the following information on the official documentation (https://php.net) about session_destroy:

It does not unset any of the global variables associated with the session, or unset the session cookie.
source: http://php.net/manual/en/function.session-destroy.php

And the documentation of session_unset says the following:

The session_unset() function frees all session variables currently registered.
source: http://php.net/manual/en/function.session-unset.php

So with these informations you have to call the following to clear a session completely:

session_unset();
session_destroy();

You don't want to clear the whole session?

In case your are using a system to login and logout a user, you can also remove specific fields of the session using unset:

unset($_SESSION['username']);
unset($_SESSION['other_user_data']);

In this case you only remove data of the user and not data for other parts of your application not related to the user.