Destroying sessions in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this PHP session destruction code?

Consider the following PHP code that starts a session, sets a variable, destroys the session, and then tries to access the variable. What will be the output?

PHP

<?php
session_start();
$_SESSION['user'] = 'Alice';
session_destroy();
echo isset($_SESSION['user']) ? $_SESSION['user'] : 'No user';
?>

A Alice

B No user

C Undefined index: user

D Fatal error: session_destroy() expects exactly 0 parameters

💡 Hint

Think about what happens to session variables after session_destroy() is called.

Calling session_destroy() ends the session and clears session data on the server, but the $_SESSION superglobal in the current script is not automatically cleared. Therefore, isset($_SESSION['user']) returns true, and 'Alice' is printed.

❓ Predict Output

intermediate

What happens after unsetting session variables but not destroying the session?

What will this PHP code output?

PHP

<?php
session_start();
$_SESSION['count'] = 5;
unset($_SESSION['count']);
echo isset($_SESSION['count']) ? $_SESSION['count'] : 'Count not set';
?>

A Fatal error: Cannot unset session variable

B Count not set

C Notice: Undefined index: count

D 5

💡 Hint

What does unset() do to the session variable?

Using unset() on a session variable removes it from the $_SESSION array. So after unsetting, $_SESSION['count'] no longer exists, and the isset() check returns false, printing 'Count not set'.

🔧 Debug

advanced

Why does this session not destroy properly?

Look at this PHP code snippet intended to destroy a session. Why does it fail to fully destroy the session?

PHP

<?php
session_start();
$_SESSION['logged_in'] = true;
session_destroy();
echo isset($_SESSION['logged_in']) ? 'Still logged in' : 'Logged out';
?>

A Because <code>$_SESSION</code> variables are automatically deleted after <code>session_destroy()</code>

B Because <code>session_start()</code> was not called before <code>session_destroy()</code>

C Because <code>session_destroy()</code> requires a parameter to clear session variables

D Because <code>session_destroy()</code> does not clear <code>$_SESSION</code> array in current script

💡 Hint

Check what session_destroy() does and what it does not do.

session_destroy() removes the session data stored on the server but does not clear the $_SESSION array in the current script. So the variable $_SESSION['logged_in'] still exists in the script's memory until manually cleared or the script ends.

📝 Syntax

advanced

Which option correctly destroys a PHP session and clears session variables?

Which of the following PHP code snippets correctly destroys the session and clears all session variables?

A <?php session_start(); $_SESSION = array(); session_destroy(); ?>

B <?php session_start(); session_destroy(); $_SESSION = array(); ?>

C <?php session_destroy(); session_start(); $_SESSION = array(); ?>

D <?php $_SESSION = array(); session_destroy(); session_start(); ?>

💡 Hint

Remember the order: you must start the session before modifying or destroying it.

You must call session_start() first to access the session. Then clear $_SESSION array to remove variables, and finally call session_destroy() to remove session data on the server. Option A follows this order correctly.

🚀 Application

expert

How many session variables remain after this code runs?

Given this PHP code, how many session variables remain in $_SESSION after execution?

PHP

<?php
session_start();
$_SESSION['a'] = 1;
$_SESSION['b'] = 2;
$_SESSION['c'] = 3;
unset($_SESSION['b']);
session_destroy();
?>

A 3

B 1

C 2

D 0

💡 Hint

Consider what unset() and session_destroy() do to $_SESSION in the current script.

unset($_SESSION['b']) removes the 'b' variable, so only 'a' and 'c' remain in the $_SESSION array. session_destroy() deletes the session data on the server but does not clear the $_SESSION array in the current script. So after execution, $_SESSION still contains 2 variables: 'a' and 'c'.

Practice

1. What is the main purpose of calling session_destroy() in PHP?

easy

A. To end the current session and delete all session data on the server

B. To start a new session

C. To clear only the session cookie on the client side

D. To reset the session ID without deleting data

Solution

1. Step 1: Understand what session_destroy() does

   This function ends the current session and removes all session data stored on the server.

2. Step 2: Compare with other session functions

   Functions like session_start() start a session, and session_unset() clears session variables but does not end the session.

3. Final Answer:

   To end the current session and delete all session data on the server -> Option A

4. Quick Check:

   session_destroy() ends session = B [OK]

Hint: session_destroy() ends session and clears data [OK]

Common Mistakes:

• Confusing session_destroy() with session_unset()
• Thinking session_destroy() resets session ID
• Assuming session_destroy() clears client cookies only

2. Which of the following is the correct sequence to properly destroy a session in PHP?

easy

A. session_destroy(); session_unset(); session_start();

B. session_destroy(); session_start(); session_unset();

C. session_unset(); session_destroy(); session_start();

D. session_start(); session_unset(); session_destroy();

Solution

1. Step 1: Start the session before destroying

   You must call session_start() to access the session data before clearing or destroying it.

2. Step 2: Clear session variables then destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Final Answer:

   session_start(); session_unset(); session_destroy(); -> Option D

4. Quick Check:

   Start, unset, destroy = A [OK]

Hint: Always start session before unsetting or destroying [OK]

Common Mistakes:

• Calling session_destroy() before session_start()
• Not calling session_unset() before session_destroy()
• Calling session_start() after destroying session

3. What will be the output of the following PHP code?

session_start();
$_SESSION['user'] = 'Alice';
session_unset();
echo isset($_SESSION['user']) ? 'Exists' : 'Not exists';

medium

A. Exists

B. Error: Undefined index

C. Not exists

D. Empty string

Solution

1. Step 1: Set and then unset session variables

   The code sets $_SESSION['user'] to 'Alice', then calls session_unset() which clears all session variables.

2. Step 2: Check if session variable exists after unset

   Since variables are cleared, isset($_SESSION['user']) returns false, so output is 'Not exists'.

3. Final Answer:

   Not exists -> Option C

4. Quick Check:

   session_unset() clears variables = C [OK]

Hint: session_unset() clears variables, so isset returns false [OK]

Common Mistakes:

• Assuming session_unset() deletes session completely
• Expecting variable to still exist after session_unset()
• Confusing session_unset() with session_destroy()

4. Identify the error in the following code snippet that aims to destroy a session:

session_unset();
session_destroy();

medium

A. No error, code works fine

B. Missing session_start() before unsetting and destroying

C. session_unset() does not clear session variables

D. session_destroy() should be called before session_unset()

Solution

1. Step 1: Check session lifecycle requirements

   Before accessing or modifying session data, session_start() must be called to initialize the session.

2. Step 2: Analyze the given code

   The code calls session_unset() and session_destroy() without starting the session, which causes errors or unexpected behavior.

3. Final Answer:

   Missing session_start() before unsetting and destroying -> Option B

4. Quick Check:

   Always start session before unsetting/destroying [OK]

Hint: Always call session_start() before session_unset() or session_destroy() [OK]

Common Mistakes:

• Forgetting to call session_start() first
• Calling session_destroy() before session_unset() (not an error but unusual)
• Assuming session_unset() destroys session

5. You want to completely log out a user by destroying the session and removing the session cookie. Which of the following code snippets correctly achieves this?

hard

A. session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600);

B. session_destroy(); session_unset(); setcookie(session_name(), '', time() + 3600);

C. session_start(); session_destroy(); setcookie(session_name(), '', time() + 3600);

D. session_unset(); session_start(); setcookie(session_name(), '', time() - 3600);

Solution

1. Step 1: Start the session to access session data

   Call session_start() to initialize the session before modifying it.

2. Step 2: Clear session variables and destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Step 3: Remove the session cookie from the client

   Call setcookie() with the session name and a past expiration time to delete the cookie.

4. Final Answer:

   session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600); -> Option A

5. Quick Check:

   Start, unset, destroy, delete cookie = A [OK]

Hint: Start session, unset, destroy, then expire cookie [OK]

Common Mistakes:

• Not starting session before destroying
• Setting cookie expiration in the future instead of past
• Not removing session cookie after destroying session