PHP $ _SESSION，尝试访问用户表时不显示输出，当会话被终止时，会话保持活动状态

Question

i'm trying to a build a secure sessionID. Usually i store the UserID as the $_SESSION['session'];, now im not too sure if it is really secure to have the userID as the sessionID. so what i have done is tested this theory although now i cannot access the users information and after i kill the session the sessions are still active and available?

CODE to check login if true or false:

if(password_verify($userPass, $user['userPasswd']))
{
    session_start();
    $UID = str_replace($user['text'].$user['text1'], '', $user['uniqID']);
    $_SESSION['SESSION'] = sha1(md5(sha1($UID)));
    return true;
} else {
    return false;
}

Logout Script: EDIT fixed using $_SESSION = array();

public function userLogout()
{
     session_destroy();
     unset($_SESSION['SESSION']);
     return true;
}

Script to access users table information (username, email etc):

$userID = $_SESSION['SESSION'];
$stmt = $userClass->runQuery("SELECT * FROM users WHERE uniqID=:userID");
$stmt->execute(array(":userID"=>$userID));
$user = $stmt->fetch(PDO::FETCH_ASSOC);

print_r($_SESSION['SESSION']); //Prints out session even if not logged in 
print $user['Username']; //Prints out nothing

i'm not sure if i missed a step or if hashing a session is even necessary, maybe i am doing something incorrectly. Essentially i am trying to secure the userID via a hash instead of having it displaying the users actual ID. Using the hash i would like to match and gain access to the users column.

ADDITIONAL NOTE: if i change the session to get the actual userID eg: 1

$userID = 1; //i did set the $_SESSION var to the userID to check if logout works
$stmt = $userClass->runQuery("SELECT * FROM users WHERE userID=:userID");
$stmt->execute(array(":userID"=>$userID));
$user = $stmt->fetch(PDO::FETCH_ASSOC);

print_r($_SESSION['SESSION']); //prints out 1 //still does not destroy session after userLogout() is initiated 
print $user['Username']; //Prints username which is correct 

been boggled by this for hours, maybe a different set of eyes and experience might help x_x.

Answer 1

(this is a comment, but its a bit long)

As ADyson says, this is very confused coding. Neither your code nor your narrative explain what you are trying to achieve here. What is the threat model? What is your definition of "secure"? $_SESSION['SESSION'] is not the session id.

If you store a static map between the (effectively random, but not random enough) identifier stored in the session and the username, then all you've done is limit the performance and scalability of the system - I cannot see how it adds any value for security.

There is a usage model where you might want a warrant-proof user database, where you would hash usernames - but this is not it.

There are models for protecting the session data from other subscribers on a shared host (with poor partitioning). This is not that either.

There are models for ensuring that session data is protected in backups....and, nope, this isn't very good for that either.

sha1(md5(sha1($UID)));

This is silly.

Take some time to understand how the default session handler actually works before you start trying to improve it by throwing code at it (hint: there are things in there which are not suitable for every application, but if you want to improve them, use a custom handler - not wrapping the default handler in additional code). But before you write any code, you need to get your head around exactly what you are trying to achieve.