Destroying sessions in PHP - Mini Project: Build & Apply

Destroying sessions

📖 Scenario: You are building a simple PHP web application that uses sessions to keep track of user login status. When the user logs out, you want to safely destroy the session to protect their information.

🎯 Goal: Learn how to start a session, set session variables, and then properly destroy the session when the user logs out.

📋 What You'll Learn

Create a session and set a session variable

Add a variable to track if the user is logged in

Write code to destroy the session safely

Print a message confirming the session is destroyed

💡 Why This Matters

🌍 Real World

Websites use sessions to remember who you are when you log in. Destroying sessions properly helps keep your account safe when you log out.

💼 Career

Web developers need to manage sessions securely to protect user data and prevent unauthorized access.

1

Start a session and set a session variable

Write PHP code to start a session using session_start() and then set a session variable called username with the value 'Alice'.

PHP

<?php
session_start();
// Your code here

Hint

Use session_start() at the top to begin the session. Then assign the username to $_SESSION['username'].

2

Add a variable to track login status

Add a session variable called logged_in and set it to true to indicate the user is logged in.

PHP

<?php
session_start();
$_SESSION['username'] = 'Alice';
// Your code here

Hint

Set $_SESSION['logged_in'] = true; to mark the user as logged in.

3

Destroy the session safely

Write PHP code to destroy the session safely by calling session_unset() and session_destroy().

PHP

<?php
session_start();
$_SESSION['username'] = 'Alice';
$_SESSION['logged_in'] = true;
// Your code here

Hint

Use session_unset() to clear all session variables, then session_destroy() to end the session.

4

Print confirmation message

Write a print statement to display the message 'Session destroyed successfully.'.

PHP

<?php
session_start();
session_unset();
session_destroy();
// Your code here

Hint

Use print('Session destroyed successfully.'); to show the message.

Practice

1. What is the main purpose of calling session_destroy() in PHP?

easy

A. To end the current session and delete all session data on the server

B. To start a new session

C. To clear only the session cookie on the client side

D. To reset the session ID without deleting data

Solution

1. Step 1: Understand what session_destroy() does

   This function ends the current session and removes all session data stored on the server.

2. Step 2: Compare with other session functions

   Functions like session_start() start a session, and session_unset() clears session variables but does not end the session.

3. Final Answer:

   To end the current session and delete all session data on the server -> Option A

4. Quick Check:

   session_destroy() ends session = B [OK]

Hint: session_destroy() ends session and clears data [OK]

Common Mistakes:

• Confusing session_destroy() with session_unset()
• Thinking session_destroy() resets session ID
• Assuming session_destroy() clears client cookies only

2. Which of the following is the correct sequence to properly destroy a session in PHP?

easy

A. session_destroy(); session_unset(); session_start();

B. session_destroy(); session_start(); session_unset();

C. session_unset(); session_destroy(); session_start();

D. session_start(); session_unset(); session_destroy();

Solution

1. Step 1: Start the session before destroying

   You must call session_start() to access the session data before clearing or destroying it.

2. Step 2: Clear session variables then destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Final Answer:

   session_start(); session_unset(); session_destroy(); -> Option D

4. Quick Check:

   Start, unset, destroy = A [OK]

Hint: Always start session before unsetting or destroying [OK]

Common Mistakes:

• Calling session_destroy() before session_start()
• Not calling session_unset() before session_destroy()
• Calling session_start() after destroying session

3. What will be the output of the following PHP code?

session_start();
$_SESSION['user'] = 'Alice';
session_unset();
echo isset($_SESSION['user']) ? 'Exists' : 'Not exists';

medium

A. Exists

B. Error: Undefined index

C. Not exists

D. Empty string

Solution

1. Step 1: Set and then unset session variables

   The code sets $_SESSION['user'] to 'Alice', then calls session_unset() which clears all session variables.

2. Step 2: Check if session variable exists after unset

   Since variables are cleared, isset($_SESSION['user']) returns false, so output is 'Not exists'.

3. Final Answer:

   Not exists -> Option C

4. Quick Check:

   session_unset() clears variables = C [OK]

Hint: session_unset() clears variables, so isset returns false [OK]

Common Mistakes:

• Assuming session_unset() deletes session completely
• Expecting variable to still exist after session_unset()
• Confusing session_unset() with session_destroy()

4. Identify the error in the following code snippet that aims to destroy a session:

session_unset();
session_destroy();

medium

A. No error, code works fine

B. Missing session_start() before unsetting and destroying

C. session_unset() does not clear session variables

D. session_destroy() should be called before session_unset()

Solution

1. Step 1: Check session lifecycle requirements

   Before accessing or modifying session data, session_start() must be called to initialize the session.

2. Step 2: Analyze the given code

   The code calls session_unset() and session_destroy() without starting the session, which causes errors or unexpected behavior.

3. Final Answer:

   Missing session_start() before unsetting and destroying -> Option B

4. Quick Check:

   Always start session before unsetting/destroying [OK]

Hint: Always call session_start() before session_unset() or session_destroy() [OK]

Common Mistakes:

• Forgetting to call session_start() first
• Calling session_destroy() before session_unset() (not an error but unusual)
• Assuming session_unset() destroys session

5. You want to completely log out a user by destroying the session and removing the session cookie. Which of the following code snippets correctly achieves this?

hard

A. session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600);

B. session_destroy(); session_unset(); setcookie(session_name(), '', time() + 3600);

C. session_start(); session_destroy(); setcookie(session_name(), '', time() + 3600);

D. session_unset(); session_start(); setcookie(session_name(), '', time() - 3600);

Solution

1. Step 1: Start the session to access session data

   Call session_start() to initialize the session before modifying it.

2. Step 2: Clear session variables and destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Step 3: Remove the session cookie from the client

   Call setcookie() with the session name and a past expiration time to delete the cookie.

4. Final Answer:

   session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600); -> Option A

5. Quick Check:

   Start, unset, destroy, delete cookie = A [OK]

Hint: Start session, unset, destroy, then expire cookie [OK]

Common Mistakes:

• Not starting session before destroying
• Setting cookie expiration in the future instead of past
• Not removing session cookie after destroying session