Destroy a PHP session on clicking a link

Question 1

Is this code valid?

<a href="#" onclick="<?php session_destroy();?>">Logout</a>

Question 2

No it is not a valid code. It will destroy the session at the time of loading the php page.

For destroying session on click you should write

<a href="logout.php" >Logout</a>

in logout.php

session_destroy();

Question 3

You can set the value to "None" using ini_set. There's no check that the value is supported when that function is used:

ini_set('session.cookie_samesite', 'None');
session_start();

session_set_cookie_params can also set it:

session_set_cookie_params(['samesite' => 'None']);
session_start();

The bug report for this to be supported in php.ini is here.

As @shrimpwagon said in a comment below, session.cookie_secure must be true for this to work. PHP doesn't require it, but browsers do.

Question 4

Yes, it's true. Both sessions and normal cookies are normal cookies. If a user does not accept cookies, he cannot use any of the functionality enabled by them. Which means pretty much the whole internet would break for that user, which is why in this day and age there's virtually nobody who has cookies disabled entirely.

PHP has a built-in mechanism called transparent session ids, which automagically rewrites all links to contain the session id in a query parameter. I would not suggest using it, since session ids in the URL open up a whole new can of worms.

For user friendliness, I'd recommend you test whether the user has cookies enabled or not (set a cookie, redirect to the next page with a flag in the URL that cookies should be set, see if you get any cookies back) and if not, kindly advise the user to enable them.

Question 5

After searching long and hard, and far and wide we've found a (what we think is the only) solution: create a function to loop through every one of these 'mini-queries' individually and it seems to be a lot more happy now! We actually came across this suggestion before but we rejected it initially because it would (and did) take a lot of time to separate 973 lines of code to split all the individual database additions...

$populate = 
"
    CREATE TEMPORARY TABLE IF NOT EXISTS `mldb`.`TempSchool`
    (
        `CentreNo` INT UNSIGNED NOT NULL,
        `School` VARCHAR(255) NULL,
        `Street` VARCHAR(255) NULL,
        `Town` VARCHAR(255) NULL,
        `County` VARCHAR(255) NULL,
        `Postcode` VARCHAR(10) NULL,
        `Tel` VARCHAR(45) NULL,
        `URL` VARCHAR(512) NULL,
        `Email` VARCHAR(255) NULL,
        `Headteacher` VARCHAR(255) NULL,
        `LEA` VARCHAR(45) NULL,
        `LEANo` INT UNSIGNED NULL,
        `EstablishmentNo` INT UNSIGNED NULL,
        `URN` INT UNSIGNED NULL,
        `Governance` VARCHAR(45) NULL,
        `Phase` VARCHAR(45) NULL,
        PRIMARY KEY (`CentreNo`)
    )
    ENGINE = InnoDB ;

" ;
populate ($dbc, $populate);


$populate = 
"   
    LOAD DATA INFILE '$path'
    IGNORE INTO TABLE `mldb`.`TempSchool`
    FIELDS TERMINATED BY ','
    OPTIONALLY ENCLOSED BY '"'
    LINES TERMINATED BY '\r\n'
    IGNORE 1 LINES
        (@AdNo, @UPN, @ULN, @UCI, @CandidateNo, @LegalSurname, @LegalForename, 
        @PreferredSurname, @PreferredForename, @Gender, @DOB, @Email,
        @InCare, @EverInCare, @FSM, @FSMEver6, @EAL, @SENStatus, @AMA,
        @Attendance, @RegGroup, @YearGroup, @EnteredYearDate, 
        @Class, @Subject, @Staff, @Initials, 
        CentreNo, School, Street, Town, County, Postcode, Tel, URL,
        Email, Headteacher, LEA, LEANo, EstablishmentNo, Governance, Phase)
" ;
populate ($dbc, $populate);

Question 6

The form button is just like any other form button, nothing special. Catch the POST on the php side of things, and use session_destroy(); to kill the session data entirely.

See this guide for info about forms and post if you're hazy on the subject: http://www.tizag.com/phpT/postget.php and this http://www.tizag.com/phpT/phpsessions.php for info about sessions

More info about forms and PHP and how to work with the data from the form: http://www.tizag.com/phpT/forms.php

Example:

Order.html:

<html><body>
<h4>Tizag Art Supply Order Form</h4>
<form action="process.php" method="post">
<input type="submit" />
</form>
</body></html>

process.php:

<html><body>
<?php
session_destroy();
?>
</body></html>

It's cheesy...does this help?

Destroy a PHP session on clicking a link

Answers

php,session,onclick,session-cookies,destroy