note 68508 deleted from function.session-destroy by bjori

Note Submitter: Alex Matulich Reason: bad code ---- I had a frustrating problem with the 'sess_deleted' file left behind by session_destroy(). When a user logs off my site, my logoff.php script deletes the session cookie and destroys the session. However, any logged-off user who attempts to re-log in without first closing the browser, doesn't get a new session ID. Instead, these users all end up sharing the 'sess_deleted' session because their session cookie still exists with the value 'deleted'. Needless to say, this causes all sorts of conflicts, user account collisions, etc. between multiple users all sharing 'sess_deleted.' The solution is to regenerate the session ID if needed, after calling session_start(): session_start(); if (session_id() == 'deleted') // invalid session ID session_regenerate_id(true);