when to destroy session data on form - php

Question

I have a form that includes SS numbers. I have done all the security/injections,spamming and validation stuff as it is not included in the question.
basically I want to destroy session data after the form emails both the user and the agent. and wipe the server clean afterward.
Do i do this like this on the final page of the form?
notes:
page 1 user will input all the data.
page 2 uses session to input the data into a conformation page that the user hits the submit button and the mailer mails the info and takes them to page 3 the success page
Technically once the data gets to page 2 I don't need the session anymore
<form id="form_958713" class="appnitro" method="post" action="mailer.php
<?php
// Initialize the session.
session_start();
// Unset all of the session variables.
$_SESSION = array();
// Note: This will destroy the session, and not just the session data!
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
// Finally, destroy the session.
session_destroy();
?>
">
or do i do it on the mailer itself?
snippet:
// gives success or error
if(!$mail->Send()) {
echo 'Message could not be sent.';
exit;
}
echo '
<meta http-equiv="refresh" content="0;url=http://www.website.com/GetaQuoteSuccess.php">
';
// Initialize the session.
session_start();
// Unset all of the session variables.
$_SESSION = array();
// Note: This will destroy the session, and not just the session data!
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
// Finally, destroy the session.
session_destroy();
?>
what is the best method/place to put the code to wipe the session?

Answer 1

Destroying the session is a very bad idea. In this site these 2 pages may be the only place you use $_SESSION but normally it is used for many things.
Instead try this concept :-
Form1.php ( the form that captures data from the user )
just posts data to form2.php
Form2.php
<?php
$session_start()
// validate $_POST of course, and once valid
$_SESSION['post_data'] = $_POST
// other code
header('Location: form3.php');
exit;
?>
Form3.php
<?php
session_start();
// use $_SESSION['post_data']['field1'] etc however you want
. . .
// at end of script if you no longer want this data
unset($_SESSION['post_data']);
// the post-data array will no longer exists in $_SESSION
// **But other data in $_SESSION is still there**
Oh but dont use unset($_SESSION); there be dragons

Answer 2

If you really need to destroy the whole session then do it at the end of the main script