session_destroy（）+ session_start（）不在标题重定向之后

Question

Trying to temporary store information in a multipage sign up. Because I don't want old sessions to mess with the new sign up data I'm trying to destroy the old session. The problem is the following.

Not working:

signup1.php

//Start new session
session_regenerate_id(TRUE);
session_destroy();
unset($_SESSION);
session_start();

//Store values in session
$_SESSION['created']    = time(); 

//Redirect to second step
header('Location: '.$settings->siteurl.'signup2.php');
exit();

signup2.php

<pre>
<?php 
    //Print $_SESSION (empty array)
    print_r($_SESSION); 
?>

Working (but returns old $_SESSION values + updated values):

//Start new session
session_regenerate_id(TRUE);

//Store values in session
$_SESSION['created']    = time(); 

//Redirect to second step
header('Location: '.$settings->siteurl.'signup2.php');
exit();

What could resolve the problem? First session_start(); is set in init.php but it doesn't matter if I place it above session_regenerate_id(TRUE), array stays empty.

Answer 1

You should use this first:

session_start(); // Starts a new or resumes an existing session

Then you may use:

session_regenerate_id(TRUE); // regenerates the active session id

The TRUE/delete_old_session parameter is used for:

Whether to delete the old associated session file or not.

The session_regenerate_id is useful to prevent session hijacking and it just regenerates a new id but keeps session data. This should be used when user's access level changes or using a time interval (i.e. after every 10 minutes) but before you regenerate another new session id you need to start the session first.