Destroying sessions in PHP - Step-by-Step Execution

Concept Flow - Destroying sessions

Start session

↓

Unset session variables

↓

Destroy session data

↓

Delete session cookie

↓

Session destroyed, user logged out

This flow shows how PHP destroys a session by unsetting variables, destroying data, and deleting the cookie.

Execution Sample

PHP

<?php
session_start();
$_SESSION['user'] = 'Alice';

// Destroy session
session_unset();
session_destroy();

// Delete session cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}
?>

Starts a session, sets a user, then unsets and destroys the session, and deletes the session cookie.

Execution Table

Step	Action	Session Variables	Session Status	Output
1	session_start()	[]	Active	Session started
2	$_SESSION['user'] = 'Alice'	{'user': 'Alice'}	Active	User set in session
3	session_unset()	[]	Active	Session variables cleared
4	session_destroy()	[]	Destroyed	Session destroyed
5	Delete session cookie	[]	Destroyed	Session cookie deleted
6	End	[]	No active session	Session fully removed

💡 Session destroyed and variables cleared, no active session remains

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
$_SESSION	[]	[]	{'user': 'Alice'}	[]	[]	[]	[]
Session Status	Inactive	Active	Active	Active	Destroyed	Destroyed	No active session

Key Moments - 2 Insights

Why do we call session_unset() before session_destroy()?

session_unset() clears all session variables but keeps the session active. session_destroy() removes the session data on the server. Both are needed to fully clear session info as shown in steps 3 and 4.

Does session_destroy() delete the session cookie automatically?

No, session_destroy() removes session data on the server but does not delete the cookie on the browser. You must delete the cookie manually if you want to remove it.

Visual Quiz - 3 Questions

Look at the execution table, what is the state of $_SESSION after step 3?

A Empty array []

B {'user': 'Alice'}

C Session destroyed

D Session inactive

💡 Hint

Check the 'Session Variables' column at step 3 in the execution table.

At which step does the session become destroyed?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Session Status' column to find when it changes to 'Destroyed'.

If you want to remove the session cookie from the browser, what should you do?

A Call session_unset()

B Manually delete the cookie with setcookie()

C Call session_destroy()

D Nothing, it deletes automatically

💡 Hint

Refer to the key moment about session_destroy() and cookie deletion.

Concept Snapshot

PHP sessions store user data on the server.
Use session_start() to begin.
Use session_unset() to clear variables.
Use session_destroy() to remove session data.
Delete session cookie manually to remove from browser.
This fully logs out the user.

Full Transcript

This visual execution shows how PHP destroys sessions step-by-step. First, session_start() activates the session. Then, a session variable 'user' is set to 'Alice'. Calling session_unset() clears all session variables but keeps the session active. Next, session_destroy() removes the session data on the server, marking the session as destroyed. Finally, the session cookie is deleted manually to fully remove the session from the browser. This process ensures the user is fully logged out and session data is cleared.