PHP 4.0 Bug #5231 Updated: session_destroy() doesn't.

ID: 5231 User Update by: chris-php-bugs@digitaria.com Status: Open Bug Type: Session related Description: session_destroy() doesn't. There was an omission in the original report. The problem with session_destroy() was exposed because I had included some code in my session logic that correctly set the session cookie with the path session_start() should set but does not (see bug #4920). My logout function is now: session_destroy(); // Manually expire things since session_destroy doesn't. $CookieParms = session_get_cookie_params(); setcookie(session_name(), '', time(), $CookieParms["path"], $CookieParms["domain"]); setcookie(session_name(), '', time(), '/members/', $CookieParms["domain"]); This works in that the browser will stop using that session ID and will thus be assigned a new one by the next session start. However, the big problem here is that session_destroy() doesn't actually destroy anything, contrary to the documentation. If the browser continues to ask for a given session identifier, all of that data will still be available. I can't even delete the temp file as unlink() is broken on Win32! Full Bug description available at: http://bugs.php.net/version4/?id=5231