Are there any best practices for completely destroying a session in PHP, including deleting cookies?

When destroying a session in PHP, it is important to not only unset the session variables but also destroy the session cookie to ensure complete termination of the session. This can be achieved by calling session_unset() to unset all session variables, session_destroy() to destroy the session data, and setting the session cookie to expire in the past to delete it from the client's browser. 

// Unset all session variables
$_SESSION = array();

// Destroy the session data
session_destroy();

// Expire the session cookie
if (isset($_COOKIE[session_name()])) {
    setcookie(session_name(), '', time()-42000, '/');
}

Keywords

session_destroy unset $_SESSION setcookie session_unset

Related Questions