How to delete a PHP session?

Question

It's possible I'm not properly deleting PHP sessions when the user signs out. I've noticed that if I sign out and sign back in without closing the browser, the session ID doesn't change but if I sign out, close the browser window, open a new one and sign in, the session ID will be different. Do I need to be doing something different or is this normal behavior? I've been using the same process for three years but something happened recently that made me think that maybe I need to do something different.

Here's what I basically do when someone clicks Sign Out.

<?php

session_start();

if( isSet($_SESSION['FacID']) )
 $facID = $_SESSION['FacID']; //Want to re-instate this after we destroy the session.

unset($_SESSION);
session_destroy();

if( isSet($_SESSION['FacID']) )
 $_SESSION['FacID'] = $facID;

?>

Answer 1

What's with the massive save-and-destroy? Just session_start and set your variables. No need to destroy, then reset them!

Your "problem" with the browser is that when you close your browser window, your browser is deleting the cookie which PHP sends it so it knows the session ID. This is a browser option and cannot be changed on the server side (unless you exploit). It can be circumvented using some methods, but that's probably not your best option.

Answer 2

If you feel the need to force a new id http://pl.php.net/manual/en/function.session-regenerate-id.php

And to your question, from the manual:

session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. To use the session variables again, session_start() has to be called.

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

Answer 3

Your session is getting destroyed.

PHP will only generate a session id if the browser isn't specifying one. As long as the session has been destoryed, there is no problems with this.