- void session_abort ( void )
- int session_cache_expire ([ string $new_cache_expire ] )
- void session_commit ( void )
- string session_create_id ([ string $prefix ] )
- bool session_decode ( string $data )
- bool session_destroy ( void )
- string session_encode ( void )
- int session_gc ( void )
- array session_get_cookie_params ( void )
- string session_id ([ string $id ] )
- bool session_is_registered ( string $name )
- string session_module_name ([ string $module ] )
- string session_name ([ string $name ] )
- bool session_regenerate_id ([ bool $delete_old_session = false ] )
- void session_register_shutdown ( void )
- bool session_register ( mixed $name [, mixed $... ] )
- void session_reset ( void )
- string session_save_path ([ string $path ] )
- void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] )
- bool session_set_save_handler ( callable $open , callable $close , callable $read , callable $write , callable $destroy , callable $gc [, callable $create_sid [, callable $validate_sid [, callable $update_timestamp ]]] )
- bool session_start ([ array $options =  ] )
- int session_status ( void )
- bool session_unregister ( string $name )
- void session_unset ( void )
- void session_write_close ( void )
Note that calling
session_start() even if the session has already started will result in a PHP warning.
Destroy an entire session
If you've got a session which you wish to destroy, you can do this with
session_destroy() is different to using something like
$_SESSION = array(); which will remove all of the values stored in the
SESSION superglobal but it will not destroy the actual stored version of the session.
Note: We use
$_SESSION = array(); instead of
session_unset() because the manual stipulates:
Only use session_unset() for older deprecated code that does not use $_SESSION.
Manipulating session data
$_SESSION variable is an array, and you can retrieve or manipulate it like a normal array.
Also see Manipulating an Array for more reference how to work on an array.
Note that if you store an object in a session, it can be retrieved gracefully only if you have an class autoloader or you have loaded the class already. Otherwise, the object will come out as the type
__PHP_Incomplete_Class, which may later lead to crashes. See Namespacing and Autoloading about autoloading.
Session data can be hijacked. This is outlined in: Pro PHP Security: From Application Security Principles to the Implementation of XSS Defense - Chapter 7: Preventing Session Hijacking So it can be strongly recommended to never store any personal information in
$_SESSION. This would most critically include credit card numbers, government issued ids, and passwords; but would also extend into less assuming data like names, emails, phone numbers, etc which would allow a hacker to impersonate/compromise a legitimate user. As a general rule, use worthless/non-personal values, such as numerical identifiers, in session data.
Safe Session Start With no Errors
Many developers have this problem when they work on huge projects, especially if they work on some modular CMS on plugins, addons, components etc. Here is solution for safe session start where if first checked PHP version to cover all versions and on next is checked if session is started. If session not exists then I start session safe. If session exists nothing happen.
This can help you a lot to avoid
As we all are aware that PHP writes session data into a file at server side. When a request is made to php script which starts the session via
session_start(), PHP locks this session file resulting to block/wait other incoming requests for same
session_id to complete, because of which the other requests will get stuck on
session_start() until or unless the session file locked is not released
The session file remains locked until the script is completed or session is manually closed. To avoid this situation i.e. to prevent multiple requests getting blocked, we can start the session and close the session which will release the lock from session file and allow to continue the remaining requests.
Now one will think if session is closed how we will read the session values, beautify even after session is closed, session is still available. So, we can still read the session data.
In php >= 7.0, we can have read_only session, read_write session and lazy_write session, so it may not required to use
Checking if session cookies have been created
Session name is the name of the cookie used to store sessions. You can use this to detect if cookies for a session have been created for the user:
Note that this method is generally not useful unless you really don't want to create cookies unnecessarily.
Changing session name
You can update the session name by calling
If no argument is provided into
session_name() then the current session name is returned.
It should contain only alphanumeric characters; it should be short and descriptive (i.e. for users with enabled cookie warnings). The session name can't consist of digits only, at least one letter must be present. Otherwise a new session id is generated every time.
Starting with PHP Sessions we can pass an array with session-based
php.ini options to the
This feature also introduces a new
php.ini setting named
session.lazy_write, which defaults to
true and means that session data is only rewritten, if it changes.