I am trying to get rid of a bunch of session variables in PHP. I mean completely get rid of them.
I have tried some different approaches. For example:
$_SESSION = array();
session_destroy();
header('location: '.MAINPATH);
I have also tried using various compinations of session_unset, unset, setcookie etc. with the above commands.
I have of course tested if the session variables remains by doing:
echo $_SESSION['member_id'];
All of my session variables still remains for som reason.
Can anyone figure out what the problem might be?
Any help is greatly appreciated.
FWI: I am using PHP 5.5
UPDATE:
I tried changing my code to the following:
echo $_SESSION['member_id'];
session_unset();
session_destroy();
echo $_SESSION['member_id'];
which resulted in this output:
1000004 Notice: Undefined index: member_id in...
This should mean that the session variable is deletede right? The weird thing is, that when I am going back to my front page, the session variable is available again.
One more time, can you do a quick try:
<?php
session_start();
$helper = array_keys($_SESSION);
foreach ($helper as $key){
unset($_SESSION[$key]);
}
?>
you can use this code :-
session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);
use within php tag
You can use session_unset() to clear all session variables.
Related
I'm a noob programmer so I apologies in advance for any obvious mistakes. I've spent the past week creating a product database kinda thing. I've got too the point where I can add products using a form, view all products added etc. I've being using sessions which are created via the form input data. I'm struggling to include get a delete product page working, I've tried using unset to clear the variable but can't get it too work.
ADD Product page which sets the session variable:
$_SESSION['Products'][] = $_POST; //is how i set the session on the add products page.
unset $_SESSION['Products'][]; //is how i have tried to clear the session although it does not work.
Any point in the right direction will be appreciated!
You can unset session variable using:
session_unset - Frees all session variables (It is equal to using: $_SESSION = array(); for older deprecated code)
unset($_SESSION['Products']); - Unset only Products index in session variable. (Remember: You have to use like a function, not as you used)
session_destroy — Destroys all data registered to a session
To know the difference between using session_unset and session_destroy, read this SO answer. That helps.
I am including this answer in case someone comes to this page for the same reason I did. I just wasted an embarrassing amount of time trying to track the problem down. I was calling:
unset($_SESSION['myVar']);
from a logout script. Then navigating to a page that required login, and the server still thought I was logged in. The problem was that the logout script was not calling:
session_start();
Unsetting a session var DOES NOT WORK unless you start the session first.
Unset is a function. Therefore you have to submit which variable has to be destroyed.
unset($var);
In your case
unset ($_SESSION["products"]);
If you need to reset whole session variable just call
session_destroy ();
If you completely want to clear the session you can use this:
session_unset();
session_destroy();
Actually both are not neccessary but it does not hurt.
If you want to clear only a specific part I think you need this:
unset($_SESSION['Products']);
//or
$_SESSION['Products'] = "";
depending on what you need.
unset is a function, not an operator. Use it like unset($_SESSION['key']); to unset that session key. You can, however, use session_destroy(); as well. (Make sure to start the session with session_start(); as well)
Destroying a PHP Session
A PHP session can be destroyed by session_destroy() function. This function does not need any argument and a single call can destroy all the session variables. If you want to destroy a single session variable then you can use unset() function to unset a session variable.
Here is the example to unset a single variable
<?php unset($_SESSION['counter']); ?>
Here is the call which will destroy all the session variables
<?php session_destroy(); ?>
// set
$_SESSION['test'] = 1;
// destroy
unset($_SESSION['test']);
$_SESSION['Poducts'] = 1; // set
unset($_SESSION['Products']); //unset
All the answer about unset are correct but one thing is needed to be corrected. If you did not use session_start() the unset() will never work. I recommend doing it this way
session_start();
unset($_SESSION['productID']);
I'm a noob programmer so I apologies in advance for any obvious mistakes. I've spent the past week creating a product database kinda thing. I've got too the point where I can add products using a form, view all products added etc. I've being using sessions which are created via the form input data. I'm struggling to include get a delete product page working, I've tried using unset to clear the variable but can't get it too work.
ADD Product page which sets the session variable:
$_SESSION['Products'][] = $_POST; //is how i set the session on the add products page.
unset $_SESSION['Products'][]; //is how i have tried to clear the session although it does not work.
Any point in the right direction will be appreciated!
You can unset session variable using:
session_unset - Frees all session variables (It is equal to using: $_SESSION = array(); for older deprecated code)
unset($_SESSION['Products']); - Unset only Products index in session variable. (Remember: You have to use like a function, not as you used)
session_destroy — Destroys all data registered to a session
To know the difference between using session_unset and session_destroy, read this SO answer. That helps.
I am including this answer in case someone comes to this page for the same reason I did. I just wasted an embarrassing amount of time trying to track the problem down. I was calling:
unset($_SESSION['myVar']);
from a logout script. Then navigating to a page that required login, and the server still thought I was logged in. The problem was that the logout script was not calling:
session_start();
Unsetting a session var DOES NOT WORK unless you start the session first.
Unset is a function. Therefore you have to submit which variable has to be destroyed.
unset($var);
In your case
unset ($_SESSION["products"]);
If you need to reset whole session variable just call
session_destroy ();
If you completely want to clear the session you can use this:
session_unset();
session_destroy();
Actually both are not neccessary but it does not hurt.
If you want to clear only a specific part I think you need this:
unset($_SESSION['Products']);
//or
$_SESSION['Products'] = "";
depending on what you need.
unset is a function, not an operator. Use it like unset($_SESSION['key']); to unset that session key. You can, however, use session_destroy(); as well. (Make sure to start the session with session_start(); as well)
Destroying a PHP Session
A PHP session can be destroyed by session_destroy() function. This function does not need any argument and a single call can destroy all the session variables. If you want to destroy a single session variable then you can use unset() function to unset a session variable.
Here is the example to unset a single variable
<?php unset($_SESSION['counter']); ?>
Here is the call which will destroy all the session variables
<?php session_destroy(); ?>
// set
$_SESSION['test'] = 1;
// destroy
unset($_SESSION['test']);
$_SESSION['Poducts'] = 1; // set
unset($_SESSION['Products']); //unset
All the answer about unset are correct but one thing is needed to be corrected. If you did not use session_start() the unset() will never work. I recommend doing it this way
session_start();
unset($_SESSION['productID']);
I am newbie in php. I can not under stand a thing that session variable is outputting even after session_destroy() and session_unset().Here is my simple code for test
`session_start();
SESSION['name']='sovon';
session_destroy();
session_unset($_SESSION['name']);
echo $_SESSION['name'];
`
The output is 'sovon'. My question what is session_destroy() and session_unset() doing here and whats the difference between them?
Oh! when I am deleting session_destroy() that variable is getting unset. why?
I got it faisal, session_distroy is destroying session if its created in other pages. If the session variable created on the same page then it will be remain. The best practice is to null the session variable after session distroY $_SESSION = NULL;
Like I am using in logout,
session_start();
session_distory();
$_SESSION = NULL;
header('Location: Login.php');
I think this help you.
Perhaps its easier if you read the php manual.
session_destroy()
session_destroy() destroys all of the data associated with the current
session. It does not unset any of the global variables associated with
the session, or unset the session cookie. To use the session variables
again, session_start() has to be called.
So if you want to unset the data inside. You have to unset it.
unset($_SESSION);
Session unset...
session_unset()
deletes all variables and leave session_id. But session_unset has no parameters.
What you search is
unset($_SESSION['name']);
The following works perfectly in all browsers to kill and destroy and unset all session info. Perfect to put it in sign-out file.
<?php
session_start();
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);
?>
my problem is that the session variable did not get unset when running the below code.
what is wrong?
<?php
session_start();
session_unset();
//session_destroy();
header("location: user_form.php");
?>
You've not actually created a session you've started the session engine but not created a session variable.
If you have a session variable $_SESSION['userid'] for example then you can just unset that value or expire it or set its value to something that would fail your if clause for your header redirect.
Usually I do something like:
<?php
session_start();
if(!empty($_SESSION) && is_array($_SESSION)) {
foreach($_SESSION as $sessionKey => $sessionValue)
session_unset($_SESSION[$sessionKey]);
}
session_destroy();
header("Location: user_form.php");
?>
Try this syntax (use a variable name in unset):
<?php
session_start();
if(isset($_SESSION['views']))
unset($_SESSION['views']);
?>
I'm guessing you already have variables within your session set, otherwise there would be nothing to "unset".
With session_unset the session itself would still exist, as it's just the equivalent of doing:
$_SESSION = array();
Unless of course you're using PHP 4.0.6 or below, then you would be expected to use:
unset ($_SESSION['varname']);
as per session_unset.
There isn't anything "wrong" with your code so to speak.
sorry for a repetitive question, I've seen a few of these on this forum but none of the responses worked for me...
I am building a basic login using php sessions, which I'm new at...
login.php validates html login form and begins a session, setting variables: $_SESSION['login'] and $_SESSION['id],
then each page that requires a valid login uses require 'session.php'; which checks the $_SESSION['valid'] variable and redirects a user w/o proper login variable. The problem is when I logout neither session variable I've set will unset.
Right now my logout.php file uses about every method to destroy the variables that I've been able to find online and none will actually do it.
So whenever I log out, I can still access the 'private' pages.
Also note: I have tried it w/o a session name ex: session_start(); that didn't work so now I'm using session_start("user");
Also note: I am NOT using cookies.
Here are the files I mentioned:
login.php
$email=$_POST['email-log']; $pass=$_POST['password-log'];
$i=-1;
do
{$i++; $path="users/".$i.".json";
$file= file_get_contents($path);
$x=json_decode($file,true);
} while($x['email']!=$email);
$id=$i;
$truepass=$x['pass'];
$errors=0;
$hash=hash('sha256',$pass);
if($hash != $truepass){$errors=$errors+1;}
if($errors==0){
session_start("user");
$_SESSION['login']="valid";
$_SESSION['id']=$id;
header('Location: loginlanding.php');}
else{header('Location: front.php?error=y');}
session.php
session_start("user"); if($_SESSION['login'] !== "valid") {header('Location: front.php?needto=login');}
logout.php
unset($_SESSION); unset($_SESSION['login']); unset($_SESSION['id']); session_unset("user"); $_SESSION=array(); session_destroy("user"); header('Location: front.php?logged=out');
Any and all responses are welcome and I thank you in advance, also note, I am new to logins in general so any advice to beef up security is welcome also. I'm planning on making it more secure, but first I need to get this basic functionality up and running.
You should never unset($_SESSION).
The easiest way to clear the $_SESSION variable is $_SESSION = Array();
However, you can also iterate with unset:
foreach(array_keys($_SESSION) as $k) unset($_SESSION[$k]);
It's amazing how many things you're attempting to do after you've unset the only reference you had to the session in the first place. Directly from the manual:
Caution
Do NOT unset the whole $_SESSION with unset($_SESSION) as this will disable the registering of session variables through the $_SESSION superglobal.
http://php.net/manual/en/function.session-unset.php
You're unsetting $_SESSION so your unsets to the other arrays of the super global $_SESSION aren't registering, leaving them still in the browsers temporary cookies. Use session_unset() instead if you're trying to remove all session variables. Otherwise, don't unset the session global, but unset each individual value of it you want to remove.
My working example (notice that you must put start on the call)
<?php
session_start();
session_unset();
session_destroy();
header('location: ./');
?>