note 71889 deleted from function.session-destroy by googleguy

Note Submitter: r dot swets at guidance dot nl ---- Bothering with the timestamp can always give troubles. A lot better is forcing the sessionid to be regenrerated. A trick to destroy the session completly is actually restarting the session, like someone closed and reopened his browser. This will fix the whole authority problem and browser cookie deletion problem quite more easy, and it gives cleaner code without having to clean the $_SESSION array. I would suggest the following function session_restart(); <?php session_start(); // Some simple code etc etc $requested_logout = true; if ($requested_logout) { session_restart(); } // Now the session_id will be different every browser refresh print(session_id()); function session_restart() { if (session_name()=='') { // Session not started yet session_start(); } else { // Session was started, so destroy session_destroy(); // But we do want a session started for the next request session_start(); session_regenerate_id(); // PHP < 4.3.3, since it does not put setcookie(session_name(), session_id()); } } ?> NOTE: session_restart() acts like session_start(), so no output must be written before its called.