How can sessions be properly destroyed in PHP to ensure a user is logged out?

To properly destroy a session in PHP and ensure a user is logged out, you can use the session_destroy() function along with clearing session variables using session_unset(). This will unset all session variables and destroy the session data stored on the server. It's also a good practice to regenerate the session ID after destroying the session to prevent session fixation attacks. 

<?php
session_start();

// Unset all session variables
$_SESSION = array();

// Destroy the session
session_destroy();

// Regenerate session ID
session_regenerate_id(true);
?>

Keywords

session_destroy unset session_unset session_regenerate_id logout

Related Questions