Destroying sessions in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of session_destroy() in PHP?

session_destroy() ends the current session and deletes all data associated with it on the server.

beginner

Which PHP function removes all session variables but does not destroy the session itself?

session_unset() clears all session variables but keeps the session active.

beginner

Why should you call session_start() before destroying a session?

You must call session_start() to access the current session before you can destroy it.

intermediate

How do you delete the session cookie in PHP when destroying a session?

Use setcookie() with the session cookie name, an empty value, and a past expiration time.

intermediate

What is the correct order to fully destroy a PHP session?

1. Call session_start()
2. Clear session variables with $_SESSION = [] or session_unset()
3. Delete the session cookie with setcookie()
4. Call session_destroy()

What does session_destroy() do in PHP?

A Clears session variables but keeps session active

B Deletes all session data on the server

C Starts a new session

D Deletes the session cookie only

session_destroy() deletes all session data stored on the server for the current session.

Which function clears all session variables but does not destroy the session?

A session_unset()

B session_destroy()

C session_start()

D session_regenerate_id()

session_unset() removes all session variables but keeps the session itself active.

Before calling session_destroy(), what must you do?

A Call <code>session_start()</code>

B Call <code>session_unset()</code>

C Delete the session cookie

D Nothing, just call <code>session_destroy()</code>

You must call session_start() to access the session before destroying it.

How do you delete the session cookie in PHP?

A Call <code>session_destroy()</code>

B Call <code>session_start()</code>

C Set cookie with empty value and past expiration time

D Call <code>session_unset()</code>

Use setcookie() with the session cookie name, empty value, and expiration time in the past to delete it.

What is the correct sequence to fully destroy a PHP session?

A session_unset() → session_destroy() → session_start()

B session_destroy() → session_start() → delete cookie

C delete cookie → session_destroy() → session_start()

D session_start() → session_unset() → delete cookie → session_destroy()

First start the session, then clear variables, delete the cookie, and finally destroy the session.

Explain the steps needed to completely destroy a PHP session and why each step is important.

Think about both server data and client cookie.

What is the difference between session_unset() and session_destroy() in PHP?

One clears variables, the other ends the session.

Practice

1. What is the main purpose of calling session_destroy() in PHP?

easy

A. To end the current session and delete all session data on the server

B. To start a new session

C. To clear only the session cookie on the client side

D. To reset the session ID without deleting data

Solution

1. Step 1: Understand what session_destroy() does

   This function ends the current session and removes all session data stored on the server.

2. Step 2: Compare with other session functions

   Functions like session_start() start a session, and session_unset() clears session variables but does not end the session.

3. Final Answer:

   To end the current session and delete all session data on the server -> Option A

4. Quick Check:

   session_destroy() ends session = B [OK]

Hint: session_destroy() ends session and clears data [OK]

Common Mistakes:

• Confusing session_destroy() with session_unset()
• Thinking session_destroy() resets session ID
• Assuming session_destroy() clears client cookies only

2. Which of the following is the correct sequence to properly destroy a session in PHP?

easy

A. session_destroy(); session_unset(); session_start();

B. session_destroy(); session_start(); session_unset();

C. session_unset(); session_destroy(); session_start();

D. session_start(); session_unset(); session_destroy();

Solution

1. Step 1: Start the session before destroying

   You must call session_start() to access the session data before clearing or destroying it.

2. Step 2: Clear session variables then destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Final Answer:

   session_start(); session_unset(); session_destroy(); -> Option D

4. Quick Check:

   Start, unset, destroy = A [OK]

Hint: Always start session before unsetting or destroying [OK]

Common Mistakes:

• Calling session_destroy() before session_start()
• Not calling session_unset() before session_destroy()
• Calling session_start() after destroying session

3. What will be the output of the following PHP code?

session_start();
$_SESSION['user'] = 'Alice';
session_unset();
echo isset($_SESSION['user']) ? 'Exists' : 'Not exists';

medium

A. Exists

B. Error: Undefined index

C. Not exists

D. Empty string

Solution

1. Step 1: Set and then unset session variables

   The code sets $_SESSION['user'] to 'Alice', then calls session_unset() which clears all session variables.

2. Step 2: Check if session variable exists after unset

   Since variables are cleared, isset($_SESSION['user']) returns false, so output is 'Not exists'.

3. Final Answer:

   Not exists -> Option C

4. Quick Check:

   session_unset() clears variables = C [OK]

Hint: session_unset() clears variables, so isset returns false [OK]

Common Mistakes:

• Assuming session_unset() deletes session completely
• Expecting variable to still exist after session_unset()
• Confusing session_unset() with session_destroy()

4. Identify the error in the following code snippet that aims to destroy a session:

session_unset();
session_destroy();

medium

A. No error, code works fine

B. Missing session_start() before unsetting and destroying

C. session_unset() does not clear session variables

D. session_destroy() should be called before session_unset()

Solution

1. Step 1: Check session lifecycle requirements

   Before accessing or modifying session data, session_start() must be called to initialize the session.

2. Step 2: Analyze the given code

   The code calls session_unset() and session_destroy() without starting the session, which causes errors or unexpected behavior.

3. Final Answer:

   Missing session_start() before unsetting and destroying -> Option B

4. Quick Check:

   Always start session before unsetting/destroying [OK]

Hint: Always call session_start() before session_unset() or session_destroy() [OK]

Common Mistakes:

• Forgetting to call session_start() first
• Calling session_destroy() before session_unset() (not an error but unusual)
• Assuming session_unset() destroys session

5. You want to completely log out a user by destroying the session and removing the session cookie. Which of the following code snippets correctly achieves this?

hard

A. session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600);

B. session_destroy(); session_unset(); setcookie(session_name(), '', time() + 3600);

C. session_start(); session_destroy(); setcookie(session_name(), '', time() + 3600);

D. session_unset(); session_start(); setcookie(session_name(), '', time() - 3600);

Solution

1. Step 1: Start the session to access session data

   Call session_start() to initialize the session before modifying it.

2. Step 2: Clear session variables and destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Step 3: Remove the session cookie from the client

   Call setcookie() with the session name and a past expiration time to delete the cookie.

4. Final Answer:

   session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600); -> Option A

5. Quick Check:

   Start, unset, destroy, delete cookie = A [OK]

Hint: Start session, unset, destroy, then expire cookie [OK]

Common Mistakes:

• Not starting session before destroying
• Setting cookie expiration in the future instead of past
• Not removing session cookie after destroying session