What are the potential consequences of not properly destroying old sessions in PHP code?

Not properly destroying old sessions in PHP code can lead to security vulnerabilities such as session hijacking or session fixation attacks. To solve this issue, it is important to properly destroy old sessions by using session_unset() to clear all session variables and session_destroy() to destroy the session data on the server. 

// Start the session
session_start();

// Clear all session variables
$_SESSION = [];

// Destroy the session data on the server
session_destroy();

Keywords

session fixation security vulnerability session hijacking data leakage session_regenerate_id

Related Questions