Member Avatar for borobhaisab

Hiya,

Is this:

function unset_sessions()
{
    //All Sessions on the script ....
    UNSET($_SESSION['registration_form_display']);
    UNSET($_SESSION['registration_form_button_clicked']);
    UNSET($_SESSION['domain']); //Form Input
    UNSET($_SESSION['domain_email_account']); //Form Input
    UNSET($_SESSION['domain_email']); //Form Input
    UNSET($_SESSION['password']); //Form Input
    UNSET($_SESSION['errors']); Displays errors underneath the form.
    echo __LINE__; echo '<br>';//DELETE
}

unset_sessions();

the exact same as this:

session_destroy();

I ask, because sometimes the 1st one fails to unset or NULL the values of some sessions such as this:

$_SESSION['registration_form_display

And I have to destroy session. Shall I opt to destroy the sessions instead to wipe-out displaying on form previous form inputs ?

Why I created sessions for user inputs.
Let's say user filled-in 2 form fields correctly and missed 1 or input is wrong on one. When they hit the SUBMIT button, script displays errors and indicates what the error is on which particular field. But only after page reloads on submit button click.
So, if form not filled properly and submit button is clicked then form is reloaded on screen for user to correctly fill-in form before trying to submit again.
As for those fields filled correctly, clicking the submit button would delete the inputs and so I dump the inputs to the sessions and then on page load (after clicking submit button) I repopulate the input fields with their previously correct inputs.
That's why I use sessions on forms.
And yes, I do not dump passwords onto sessions or cookies.

Edited by borobhaisab
  • 2 Contributors
  • 3 Replies
  • 96 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

Short answer: they are not identical. Unsetting or setting individual session keys only changes those entries in the running script; session_destroy() removes the server-side session data (but does not automatically clear the $_SESSION array in the current script or delete the session cookie). is correct that session_destroy() wipes the session store, but be aware of those caveats documented in the PHP manual (session_destroy).

Common pitfalls that make “unsets” look like they failed:

  • Session was not started on the page where you try to clear values (call session_start() first).
  • Code re-assigns the same keys later in the request.
  • Tests use isset() / empty() / array_key_exists() differently; assigning NULL, '', 0 or false is not the same as removing the key.
    For clearing all variables in the current script use session_unset() or reset $_SESSION to an empty array (session_unset).

If the goal is a reliable full wipe (including cookie), use this sequence:

session_start();
$_SESSION = array();
if (ini_get("session.use_cookies")) {
  $params = session_get_cookie_params();
  setcookie(session_name(), '', time() - 42000,
    $params["path"], $params["domain"], $params["secure"], $params["httponly"]);
}
session_destroy();

For form handling, prefer Post/Redirect/Get and store “flash” old-inputs/errors in session only until after the redirect, then clear them. This avoids stale values and accidental logout if you destroy a session that also holds authentication data.

Recommended Answers

All 3 Replies

Member Avatar for borobhaisab

Folks,

Are these 4 same:

1


function unset_sessions()
{
    $_SESSION['registration_form_display']='';
    $_SESSION['registration_form_button_clicked']='';
    $_SESSION['domain']='';
    $_SESSION['domain_email_account']='';
    $_SESSION['domain_email']='';
    $_SESSION['password']='';
    $_SESSION['errors']='';
}

2


function unset_sessions()
{
    $_SESSION['registration_form_display']=FALSE;
    $_SESSION['registration_form_button_clicked']=FALSE;
    $_SESSION['domain']=FALSE;
    $_SESSION['domain_email_account']=FALSE;
    $_SESSION['domain_email']=FALSE;
    $_SESSION['password']=FALSE;
    $_SESSION['errors']=FALSE;
}

3


function unset_sessions()
{
    $_SESSION['registration_form_display']=NULL;
    $_SESSION['registration_form_button_clicked']=NULL;
    $_SESSION['domain']=NULL;
    $_SESSION['domain_email_account']=NULL;
    $_SESSION['domain_email']=NULL;
    $_SESSION['password']=NULL;
    $_SESSION['errors']=NULL;
}

4


function unset_sessions()
{
    $_SESSION['registration_form_display']=0;
    $_SESSION['registration_form_button_clicked']=0;
    $_SESSION['domain']=0;
    $_SESSION['domain_email_account']=0;
    $_SESSION['domain_email']=0;
    $_SESSION['password']=0;
    $_SESSION['errors']=0;
}
Edited by borobhaisab
Member Avatar for borobhaisab

Folks,

This does not really make sense now does it ?


function unset_sessions()
{
    $_SESSION['registration_form_display']=-1;
    $_SESSION['registration_form_button_clicked']=-1;
    $_SESSION['domain']=-1;
    $_SESSION['domain_email_account']=-1;
    $_SESSION['domain_email']=-1;
    $_SESSION['password']=-1;
    $_SESSION['errors']=-1;
}
Edited by borobhaisab
Member Avatar for Dani

Why not just use session_destroy()?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.