Search the Community

As i look at the cookies on my web browser, I notice that the PHPSESSID does not get deleted after I have logged out. The logout script contains: $_SESSION = array(); // Clear the variables. session_destroy(); // Destroy the session itself. setcookie ('PHPSESSID', '', time()-3600, '/', '', 0, 0); // Destroy the cookie. Shouldn't the third line here do that? According to page 356, this line: "...sends a cookie to replace the existing session cookie in the browser" However, the content of the cookie (9580067fe06d9b5c25c89e1c230b062a) remains the same. ALSO (while I'm on the subject): While I have sessions going in my browser, I will go to a PayPal page and "buy something". When I return to my own site after completing the PayPal purchase, I find that the session values are still intact (that's good) and still have access to the original "user_id" etc. I'm unclear, really, about how a session ends other than by coding it such as in "session_destroy". Obviously, going to another page and back doesn't do it. Thanks for clarifying this for me.