Do you need to use session_unset before session_destroy?
According to w3schools (https://www.w3schools.com/php/php_sessions.asp) to remove a session (log out) you should do it this way:
session_unset();
session_destroy();
But I don't understand why you'd have to unset all session variables first, wouldn't just session_destroy
be enough?
You can find the following information on the official documentation (https://php.net) about session_destroy
:
It does not unset any of the global variables associated with the session, or unset the session cookie.
source: http://php.net/manual/en/function.session-destroy.php
And the documentation of session_unset
says the following:
The
session_unset()
function frees all session variables currently registered.
source: http://php.net/manual/en/function.session-unset.php
So with these informations you have to call the following to clear a session completely:
session_unset();
session_destroy();
You don't want to clear the whole session?
In case your are using a system to login and logout a user, you can also remove specific fields of the session using unset
:
unset($_SESSION['username']);
unset($_SESSION['other_user_data']);
In this case you only remove data of the user and not data for other parts of your application not related to the user.