[SOLVED] Sessions not DYING!!!!

[Clinton]

I changed everything so the form submitted to a login.php form and not to itself. Problem solved.

[9three]

To properly destroy a session you use the follow:

 

$_SESSION = array();
session_unset();
session_destroy();
header('index.php');

 

What $_SESSION = array(); does is outputs all the sessions and when it follows to the 2nd line, session_unset(), it unsets the array, and finally destroys it. You can however do an if statement and check if the sessions that you created exist and if they do run your block code. But this is a method I would not go with, as one day you might have different sessions and that if statement would become rather large and unnecessary.

 

Make sure you are using session_regenerate_id on every page to avoid session fixation.