Forcing a new session

Need help forcing a certain page to start new session

[AstonJay32]

How do I force a user to start a new session (with a new session id) upon viewing a certain page?

I've tried:
<?php
if(!isset($_SESSION['exists'])){
session_destroy();
session_start();
}
else session_start();
?>

This doesn't work because IE's cookies hang on the SID, so this led me to try:

<?php
ini_set('session.use_cookies' = 0);
if(!isset($_SESSION['exists'])){
session_destroy();
session_start();
}
eles session_start();
?>

This works great in terms of giving me a fresh SID, but whenever I try to pass session variables from page to page, it's giving me an 'Undefined variable' error for that varible. So it's if setting the 'use_cookies' directive has basically disabled my ability to use a session. I've included the 'session_start()' variable at the top of all pages, could that be the problem? Without it, I was getting those errors regardless of the cookies.

Many of you are probably thinking why I don't just destroy the session when they submit their order, a fine question indeed. Well, it's because the last page of the shopping cart contains a form that posts information to another third party website that handles their credit card info. I haven't yet figured out how to get PHP to post and redirect to another URL and THEN perform another task, (session_destroy() in this example). I can't destroy the session first because they need the option to go back and update their cart.

I have thought about cURL to handle this , but the post and the subsquent redirection is giving me problems as well, so I figured this whole problem can be avoided if I can just force a fresh session for each user that comes to the first page of the cart.

Hope this makes sense, and I thank you all in advance for your help and advice.

[jatar_k]

you don't necessarily need a freah session do you? wouldn't an empty one suffice?

[AstonJay32]

Hmm...
Well, at the moment no, since I had certain conditions based on whether or not a session variable had been declared, but when I think about it, I could work my way around this which AND statements to check the value as well. This way I could just do a session_unset() at the beginning, then maybe call a function to reset everything....yeah, that should work. Thank you.

One more slightly related question: Are the two variables session.gc_maxlifetime and session.gc_probablity among those that cannot be used with ini_set? I've just been trying to use these to start a fresh session and force garbage collection every time but it's not really working. Official docs list these two's changable fields as 'PHP_INI_ALL', whatever that means.

Thanks again.

[coopster]

PHP_INI_ALL is a predefined constant that means the directive entry can be set anywhere. More information regarding ini_set() [php.net] can be found on that page of the manual that directs you to the appendix [php.net].

[AstonJay32]

ok so what's the proper way to reset a session? I'm using session_unset(),but it's not working.

Well, sort of not working. I think it's cleared out on the server but not in the cookies. After I use session_unset(), then try to display a session variable after that, I get an undefined error, as I should.

But when I go to a page that contains a form which had previouslt been filled out by a user, the form checks the session variables to see whether or not anything is defined for those fields and if so, populate the fields in the form. Despite unsetting the session, the fields are still getting populated! And whenever I try session.use_cookies = 0, I can't use sessions at all.

Any thoughts?

[jatar_k]

how many individual vars are there in the session? is it possible to unset them each individually?

[coopster]

There is an example on the session_destroy() [php.net] manual page that sounds a lot like what you are going for here ...