Destroying sessions in PHP - Step-by-Step Execution

Concept Flow - Destroying sessions

Start session

↓

Unset session variables

↓

Destroy session data

↓

Delete session cookie

↓

Session destroyed, user logged out

This flow shows how PHP destroys a session by unsetting variables, destroying data, and deleting the cookie.

Execution Sample

PHP

<?php
session_start();
$_SESSION['user'] = 'Alice';

// Destroy session
session_unset();
session_destroy();

// Delete session cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}
?>

Starts a session, sets a user, then unsets and destroys the session, and deletes the session cookie.

Execution Table

Step	Action	Session Variables	Session Status	Output
1	session_start()	[]	Active	Session started
2	$_SESSION['user'] = 'Alice'	{'user': 'Alice'}	Active	User set in session
3	session_unset()	[]	Active	Session variables cleared
4	session_destroy()	[]	Destroyed	Session destroyed
5	Delete session cookie	[]	Destroyed	Session cookie deleted
6	End	[]	No active session	Session fully removed

💡 Session destroyed and variables cleared, no active session remains

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	Final
$_SESSION	[]	[]	{'user': 'Alice'}	[]	[]	[]	[]
Session Status	Inactive	Active	Active	Active	Destroyed	Destroyed	No active session

Key Moments - 2 Insights

Why do we call session_unset() before session_destroy()?

session_unset() clears all session variables but keeps the session active. session_destroy() removes the session data on the server. Both are needed to fully clear session info as shown in steps 3 and 4.

Does session_destroy() delete the session cookie automatically?

No, session_destroy() removes session data on the server but does not delete the cookie on the browser. You must delete the cookie manually if you want to remove it.

Visual Quiz - 3 Questions

Look at the execution table, what is the state of $_SESSION after step 3?

A Empty array []

B {'user': 'Alice'}

C Session destroyed

D Session inactive

💡 Hint

Check the 'Session Variables' column at step 3 in the execution table.

At which step does the session become destroyed?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Session Status' column to find when it changes to 'Destroyed'.

If you want to remove the session cookie from the browser, what should you do?

A Call session_unset()

B Manually delete the cookie with setcookie()

C Call session_destroy()

D Nothing, it deletes automatically

💡 Hint

Refer to the key moment about session_destroy() and cookie deletion.

Concept Snapshot

PHP sessions store user data on the server.
Use session_start() to begin.
Use session_unset() to clear variables.
Use session_destroy() to remove session data.
Delete session cookie manually to remove from browser.
This fully logs out the user.

Full Transcript

This visual execution shows how PHP destroys sessions step-by-step. First, session_start() activates the session. Then, a session variable 'user' is set to 'Alice'. Calling session_unset() clears all session variables but keeps the session active. Next, session_destroy() removes the session data on the server, marking the session as destroyed. Finally, the session cookie is deleted manually to fully remove the session from the browser. This process ensures the user is fully logged out and session data is cleared.

Practice

1. What is the main purpose of calling session_destroy() in PHP?

easy

A. To end the current session and delete all session data on the server

B. To start a new session

C. To clear only the session cookie on the client side

D. To reset the session ID without deleting data

Solution

1. Step 1: Understand what session_destroy() does

   This function ends the current session and removes all session data stored on the server.

2. Step 2: Compare with other session functions

   Functions like session_start() start a session, and session_unset() clears session variables but does not end the session.

3. Final Answer:

   To end the current session and delete all session data on the server -> Option A

4. Quick Check:

   session_destroy() ends session = B [OK]

Hint: session_destroy() ends session and clears data [OK]

Common Mistakes:

• Confusing session_destroy() with session_unset()
• Thinking session_destroy() resets session ID
• Assuming session_destroy() clears client cookies only

2. Which of the following is the correct sequence to properly destroy a session in PHP?

easy

A. session_destroy(); session_unset(); session_start();

B. session_destroy(); session_start(); session_unset();

C. session_unset(); session_destroy(); session_start();

D. session_start(); session_unset(); session_destroy();

Solution

1. Step 1: Start the session before destroying

   You must call session_start() to access the session data before clearing or destroying it.

2. Step 2: Clear session variables then destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Final Answer:

   session_start(); session_unset(); session_destroy(); -> Option D

4. Quick Check:

   Start, unset, destroy = A [OK]

Hint: Always start session before unsetting or destroying [OK]

Common Mistakes:

• Calling session_destroy() before session_start()
• Not calling session_unset() before session_destroy()
• Calling session_start() after destroying session

3. What will be the output of the following PHP code?

session_start();
$_SESSION['user'] = 'Alice';
session_unset();
echo isset($_SESSION['user']) ? 'Exists' : 'Not exists';

medium

A. Exists

B. Error: Undefined index

C. Not exists

D. Empty string

Solution

1. Step 1: Set and then unset session variables

   The code sets $_SESSION['user'] to 'Alice', then calls session_unset() which clears all session variables.

2. Step 2: Check if session variable exists after unset

   Since variables are cleared, isset($_SESSION['user']) returns false, so output is 'Not exists'.

3. Final Answer:

   Not exists -> Option C

4. Quick Check:

   session_unset() clears variables = C [OK]

Hint: session_unset() clears variables, so isset returns false [OK]

Common Mistakes:

• Assuming session_unset() deletes session completely
• Expecting variable to still exist after session_unset()
• Confusing session_unset() with session_destroy()

4. Identify the error in the following code snippet that aims to destroy a session:

session_unset();
session_destroy();

medium

A. No error, code works fine

B. Missing session_start() before unsetting and destroying

C. session_unset() does not clear session variables

D. session_destroy() should be called before session_unset()

Solution

1. Step 1: Check session lifecycle requirements

   Before accessing or modifying session data, session_start() must be called to initialize the session.

2. Step 2: Analyze the given code

   The code calls session_unset() and session_destroy() without starting the session, which causes errors or unexpected behavior.

3. Final Answer:

   Missing session_start() before unsetting and destroying -> Option B

4. Quick Check:

   Always start session before unsetting/destroying [OK]

Hint: Always call session_start() before session_unset() or session_destroy() [OK]

Common Mistakes:

• Forgetting to call session_start() first
• Calling session_destroy() before session_unset() (not an error but unusual)
• Assuming session_unset() destroys session

5. You want to completely log out a user by destroying the session and removing the session cookie. Which of the following code snippets correctly achieves this?

hard

A. session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600);

B. session_destroy(); session_unset(); setcookie(session_name(), '', time() + 3600);

C. session_start(); session_destroy(); setcookie(session_name(), '', time() + 3600);

D. session_unset(); session_start(); setcookie(session_name(), '', time() - 3600);

Solution

1. Step 1: Start the session to access session data

   Call session_start() to initialize the session before modifying it.

2. Step 2: Clear session variables and destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Step 3: Remove the session cookie from the client

   Call setcookie() with the session name and a past expiration time to delete the cookie.

4. Final Answer:

   session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600); -> Option A

5. Quick Check:

   Start, unset, destroy, delete cookie = A [OK]

Hint: Start session, unset, destroy, then expire cookie [OK]

Common Mistakes:

• Not starting session before destroying
• Setting cookie expiration in the future instead of past
• Not removing session cookie after destroying session