Best way to unset sessions in PHP

Question

What is the difference and most secure way to clear login sessions in PHP? Basically going to call this when a user clicks log out in my application.

I am seeing:

 session_destroy()
 session_unset()

Or simply doing:

unset($_SESSION['my_key_1']);
unset($_SESSION['my_key_2']);

What is the best way?

Answer 1

session_destroy is deleting whole session.

session_unset delete ony a variables from session - session still exist. Only data are truncated.

So, If you want to make memory free session_destroy is best.

Answer 2

The best solution I know is to use session_regenerate_id(true);

This will drop the current session data and regenerate session id.

Assigning a new session id is a good idea because it will help to treat a user as a completely new one (in case if something in your code relies on session id).

Answer 3

The session_unset() function frees all session variables currently registered. Meaning, it will do this:

unset($_SESSION);
$_SESSION = array();

The session_destroy() function will invalidate the whole session! The session hasn't took place.