Why Destroying sessions in PHP? - Purpose & Use Cases

The Big Idea

What if your logout button left your account wide open for others to use?

The Scenario

Imagine you have a website where users log in to access their personal dashboard. When they log out, you want to make sure no one else can use their account on the same computer. If you try to do this manually by deleting cookies or guessing how to clear data, it can get messy and unreliable.

The Problem

Manually clearing user data is slow and error-prone. You might forget some data, or the session might still linger, letting someone else access the account. This can cause security risks and confuse users who think they logged out but didn't really.

The Solution

Destroying sessions in PHP is a simple, reliable way to clear all user data stored on the server when they log out. It ensures the session ends cleanly, so no leftover information can be misused. This keeps user accounts safe and the website behavior predictable.

Before vs After

✗ Before

// Manually unset some session variables
unset($_SESSION['user']);
// But session still active

✓ After

// Destroy entire session cleanly
session_start();
$_SESSION = array();
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}
session_destroy();

What It Enables

It enables secure and complete user logout, protecting personal data and improving trust in your website.

Real Life Example

When you log out of your online bank, destroying the session ensures no one else using the same computer can see your account details or perform transactions.

Key Takeaways

Manual clearing of session data is unreliable and risky.

Destroying sessions in PHP cleanly ends user sessions.

This protects user data and improves website security.

Practice

1. What is the main purpose of calling session_destroy() in PHP?

easy

A. To end the current session and delete all session data on the server

B. To start a new session

C. To clear only the session cookie on the client side

D. To reset the session ID without deleting data

Solution

1. Step 1: Understand what session_destroy() does

   This function ends the current session and removes all session data stored on the server.

2. Step 2: Compare with other session functions

   Functions like session_start() start a session, and session_unset() clears session variables but does not end the session.

3. Final Answer:

   To end the current session and delete all session data on the server -> Option A

4. Quick Check:

   session_destroy() ends session = B [OK]

Hint: session_destroy() ends session and clears data [OK]

Common Mistakes:

• Confusing session_destroy() with session_unset()
• Thinking session_destroy() resets session ID
• Assuming session_destroy() clears client cookies only

2. Which of the following is the correct sequence to properly destroy a session in PHP?

easy

A. session_destroy(); session_unset(); session_start();

B. session_destroy(); session_start(); session_unset();

C. session_unset(); session_destroy(); session_start();

D. session_start(); session_unset(); session_destroy();

Solution

1. Step 1: Start the session before destroying

   You must call session_start() to access the session data before clearing or destroying it.

2. Step 2: Clear session variables then destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Final Answer:

   session_start(); session_unset(); session_destroy(); -> Option D

4. Quick Check:

   Start, unset, destroy = A [OK]

Hint: Always start session before unsetting or destroying [OK]

Common Mistakes:

• Calling session_destroy() before session_start()
• Not calling session_unset() before session_destroy()
• Calling session_start() after destroying session

3. What will be the output of the following PHP code?

session_start();
$_SESSION['user'] = 'Alice';
session_unset();
echo isset($_SESSION['user']) ? 'Exists' : 'Not exists';

medium

A. Exists

B. Error: Undefined index

C. Not exists

D. Empty string

Solution

1. Step 1: Set and then unset session variables

   The code sets $_SESSION['user'] to 'Alice', then calls session_unset() which clears all session variables.

2. Step 2: Check if session variable exists after unset

   Since variables are cleared, isset($_SESSION['user']) returns false, so output is 'Not exists'.

3. Final Answer:

   Not exists -> Option C

4. Quick Check:

   session_unset() clears variables = C [OK]

Hint: session_unset() clears variables, so isset returns false [OK]

Common Mistakes:

• Assuming session_unset() deletes session completely
• Expecting variable to still exist after session_unset()
• Confusing session_unset() with session_destroy()

4. Identify the error in the following code snippet that aims to destroy a session:

session_unset();
session_destroy();

medium

A. No error, code works fine

B. Missing session_start() before unsetting and destroying

C. session_unset() does not clear session variables

D. session_destroy() should be called before session_unset()

Solution

1. Step 1: Check session lifecycle requirements

   Before accessing or modifying session data, session_start() must be called to initialize the session.

2. Step 2: Analyze the given code

   The code calls session_unset() and session_destroy() without starting the session, which causes errors or unexpected behavior.

3. Final Answer:

   Missing session_start() before unsetting and destroying -> Option B

4. Quick Check:

   Always start session before unsetting/destroying [OK]

Hint: Always call session_start() before session_unset() or session_destroy() [OK]

Common Mistakes:

• Forgetting to call session_start() first
• Calling session_destroy() before session_unset() (not an error but unusual)
• Assuming session_unset() destroys session

5. You want to completely log out a user by destroying the session and removing the session cookie. Which of the following code snippets correctly achieves this?

hard

A. session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600);

B. session_destroy(); session_unset(); setcookie(session_name(), '', time() + 3600);

C. session_start(); session_destroy(); setcookie(session_name(), '', time() + 3600);

D. session_unset(); session_start(); setcookie(session_name(), '', time() - 3600);

Solution

1. Step 1: Start the session to access session data

   Call session_start() to initialize the session before modifying it.

2. Step 2: Clear session variables and destroy session

   Use session_unset() to clear variables, then session_destroy() to end the session.

3. Step 3: Remove the session cookie from the client

   Call setcookie() with the session name and a past expiration time to delete the cookie.

4. Final Answer:

   session_start(); session_unset(); session_destroy(); setcookie(session_name(), '', time() - 3600); -> Option A

5. Quick Check:

   Start, unset, destroy, delete cookie = A [OK]

Hint: Start session, unset, destroy, then expire cookie [OK]

Common Mistakes:

• Not starting session before destroying
• Setting cookie expiration in the future instead of past
• Not removing session cookie after destroying session