I tried to destroy all session variable by using the session_destroy() method, but after using this method, the values are not destroyed.
Why is session_destroy() not working?
Is there any other way to destroy the session in PHP?
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800))
{
session_destroy();
session_unset();
}
You need to tell PDO that you want it to throw exceptions:
$connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
Following your comment below, it is apparent that your DSN is incorrect. It should be:
$connection = new PDO('mysql:host=localhost;dbname=my_db','my_username','xxxxxxx');
Note that the syntax is dbname= rather than dbname: (which you had originally).
You can modify another users session (see below), although personally, I would recommend against it. As I imagine it can open up a whole world of session hijacking and other vulnerabilities.
With your example use case
A common user is logged, while in the same time an administrator uses the Admin functions and change some value for this user. If the value is not something obtained from the database every time, the session variable for that current logged in user need to have its value changed.
You would be better of updating the value in the database and then just checking to see if it's changed before you process the next page. If you don't want to be checking multiple user fields before each page load then when you update the user in the admin panel, you can build a hash of the values and add it to a new column called session_hash. Then just compare this field on page load
But if you still want to modify another user's session, you can set your current session_id to the targets.
// End my current session and save its id
session_start();
$my_session_id = session_id();
session_write_close();
// Modify our target session
session_id($target_id);
session_start();
$_SESSION['is_logged_in'] = false;
session_write_close();
// Start our old session again
session_id($my_session_id);
session_start();
EDIT
Example: https://www.samdjames.uk/session_example/index.php
Example Src: https://gist.github.com/SamJUK/c220e3742487567c6262238edf85695e
Instead of setting the time in ini to a fixed length, remind that session timeout is reset on reload. So create some ajax code that does a request every 5 minutes or so to a file (image or smth). This way the timer is reset every 5 minutes and users can spend a day filling out your forms.
If you want to get the number of rows returned use rowCount
// ...
$rows = $stmt->rowCount();
echo 'Rows found '.$rows;
// ...
After using
session_destroy(), the session is destroyed behind the scenes. For some reason this doesn't affect the values in$_SESSION, which was already populated for this request, but it will be empty in future requests.You can manually clear
$_SESSIONif you so desire ($_SESSION = [];).