What are the potential pitfalls of using session_unset() and session_destroy() in PHP logout scripts?

Using session_unset() only removes the session data, but leaves the session itself active. This can potentially lead to session fixation attacks. Similarly, session_destroy() destroys the session data and removes the session cookie, but does not unset the session variables. To properly logout a user and prevent session fixation attacks, it is recommended to use session_unset(), session_destroy(), and then regenerate the session ID.

session_start();

// Unset all session variables
$_SESSION = array();

// Destroy the session
session_destroy();

// Regenerate session ID to prevent session fixation
session_regenerate_id();

// Redirect to login page or any other desired location
header("Location: login.php");
exit();