note 69560 deleted from function.session-destroy by bjori
| From: | bjori@php.net | Date: | Mon, 11 Sep 2006 00:10:46 +0000 |
| Subject: | note 69560 deleted from function.session-destroy by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-116993@lists.php.net to get a copy of this message | ||
Note Submitter: webmaster at unitedscripters dot com
Reason: bad code
----
The native value of an uninitialized session is: NULL
<?php
$before=@gettype($_SESSION);
session_start();
$after=gettype($_SESSION);
print "$before $safter <br>";//prints NULL array
?>
I suggest unsetting a session by setting it to NULL, so to be compliant with its native value, which
is by the way what some scripts may expect if they are meant to check the value of the superglobal
$_SESSION in _all_ circumstances:
$_SESSION=null;
Your scripts in fact may be checking the existence of a session via
if(isset($_SESSION)){}
which is a reasonable and legitimate way to check if a session is around.
If your script checks are such, only setting the session to null would pass their tests:
<?php
session_start();
if(isset($_SESSION)){
print 'A session exists after having used session_start()<br>';
}
$_SESSION['foo']='foo';
$_SESSION=array();
if(isset($_SESSION)){
print 'A session exists after having reset it to $_SESSION=array()<br>';
}
session_destroy();
if(isset($_SESSION)){
print 'A session exists after having called in session_destroy() AND having set
$_SESSION=array()<br>';
}
$_SESSION=null;
if(isset($_SESSION)){
print 'A session exists<br>';
}
else{
print 'A session does NOT exist anymore after having set it to $_SESSION=null';
}
?>
that prints
A session exists after having used session_start()
A session exists after having reset it to $_SESSION=array()
A session exists after having called in session_destroy() AND having set $_SESSION=array()
A session does NOT exist anymore after having set it to $_SESSION=null
unset by
$_SESSION=null;
if your checks of a session involve a check of the superglobal.