What potential pitfalls should be considered when using session_destroy() in PHP scripts for logout functionality?

When using session_destroy() for logout functionality in PHP scripts, it is important to consider that it only destroys the session data on the server side. The client-side cookie containing the session ID may still exist, potentially allowing an attacker to hijack the session. To fully logout a user, it is recommended to also unset the session variables and regenerate the session ID.

// Clear all session variables
$_SESSION = array();

// Destroy the session data on the server
session_destroy();

// Regenerate the session ID to prevent session fixation attacks
session_regenerate_id(true);