Destroying sessions in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP session destruction code?

Consider the following PHP code that starts a session, sets a variable, destroys the session, and then tries to access the variable. What will be the output?

PHP

<?php
session_start();
$_SESSION['user'] = 'Alice';
session_destroy();
echo isset($_SESSION['user']) ? $_SESSION['user'] : 'No user';
?>

A Alice

B No user

C Undefined index: user

D Fatal error: session_destroy() expects exactly 0 parameters

💡 Hint

Think about what happens to session variables after session_destroy() is called.

Calling session_destroy() ends the session and clears session data on the server, but the $_SESSION superglobal in the current script is not automatically cleared. Therefore, isset($_SESSION['user']) returns true, and 'Alice' is printed.

❓ Predict Output

intermediate

What happens after unsetting session variables but not destroying the session?

What will this PHP code output?

PHP

<?php
session_start();
$_SESSION['count'] = 5;
unset($_SESSION['count']);
echo isset($_SESSION['count']) ? $_SESSION['count'] : 'Count not set';
?>

A Fatal error: Cannot unset session variable

B Count not set

C Notice: Undefined index: count

D 5

💡 Hint

What does unset() do to the session variable?

Using unset() on a session variable removes it from the $_SESSION array. So after unsetting, $_SESSION['count'] no longer exists, and the isset() check returns false, printing 'Count not set'.

🔧 Debug

advanced

Why does this session not destroy properly?

Look at this PHP code snippet intended to destroy a session. Why does it fail to fully destroy the session?

PHP

<?php
session_start();
$_SESSION['logged_in'] = true;
session_destroy();
echo isset($_SESSION['logged_in']) ? 'Still logged in' : 'Logged out';
?>

A Because <code>$_SESSION</code> variables are automatically deleted after <code>session_destroy()</code>

B Because <code>session_start()</code> was not called before <code>session_destroy()</code>

C Because <code>session_destroy()</code> requires a parameter to clear session variables

D Because <code>session_destroy()</code> does not clear <code>$_SESSION</code> array in current script

💡 Hint

Check what session_destroy() does and what it does not do.

session_destroy() removes the session data stored on the server but does not clear the $_SESSION array in the current script. So the variable $_SESSION['logged_in'] still exists in the script's memory until manually cleared or the script ends.

📝 Syntax

advanced

Which option correctly destroys a PHP session and clears session variables?

Which of the following PHP code snippets correctly destroys the session and clears all session variables?

A <?php session_start(); $_SESSION = array(); session_destroy(); ?>

B <?php session_start(); session_destroy(); $_SESSION = array(); ?>

C <?php session_destroy(); session_start(); $_SESSION = array(); ?>

D <?php $_SESSION = array(); session_destroy(); session_start(); ?>

💡 Hint

Remember the order: you must start the session before modifying or destroying it.

You must call session_start() first to access the session. Then clear $_SESSION array to remove variables, and finally call session_destroy() to remove session data on the server. Option A follows this order correctly.

🚀 Application

expert

How many session variables remain after this code runs?

Given this PHP code, how many session variables remain in $_SESSION after execution?

PHP

<?php
session_start();
$_SESSION['a'] = 1;
$_SESSION['b'] = 2;
$_SESSION['c'] = 3;
unset($_SESSION['b']);
session_destroy();
?>

A 3

B 1

C 2

D 0

💡 Hint

Consider what unset() and session_destroy() do to $_SESSION in the current script.

unset($_SESSION['b']) removes the 'b' variable, so only 'a' and 'c' remain in the $_SESSION array. session_destroy() deletes the session data on the server but does not clear the $_SESSION array in the current script. So after execution, $_SESSION still contains 2 variables: 'a' and 'c'.