Referencing *only* programmer-created session vars

I have register_globals on for some applications. This causes PHP to bring all elements of the $HTTP_***_VARS arrays into the GLOBAL namespace. Somehow, session_unset() does not unset these variables when it is called, rather, it only unset()'s programmer-created session variables. I would like to have a function that mimics session_unset(), except that it assigns session variables to blank rather than unset()'s them (for security reasons). Is there an *easy* way to access just the programmer-created session variables? Even on the page where the variables are first session_register()'d (so that they aren't yet in $HTTP_SESSION_VARS[])? TIA Kirk