php - 如何重置我的 session ID？

Question

我正试图在他成功付款后销毁 session 。

 $session_id = session_id();

    $sql = "
        UPDATE
            tbl_seat_book
        SET
            final_book = 'Y'
        WHERE
            session_id = '$session_id'
    ";
    $r = $this->db->executeQuery($sql);

        session_unset();
        session_destroy();

    echo 'Booking successfull';

但是当我订票时，会出现相同的session_id。支付成功后如何销毁session_id。

编辑:

$sql = "
        INSERT INTO
            tbl_seat_book
        SET
            booking_date = '$_REQUEST[bus_date]',
            booking_time = '$_REQUEST[bus_time]',
            bus_id = '$_REQUEST[bus_id]',
            route_id = '$_REQUEST[route_id]',
            session_id = '$session_id',
            session_start_time = '$time',
            temp_book = 'Y',
            final_book = 'N',
            $cond
    ";
    $booked = $this->db->insertQuery($sql);

EDIT2:

function book_final_tickets()
{

    $session_id = session_id();
    $sql = "
        UPDATE
            tbl_seat_book
        SET
            final_book = 'Y'
        WHERE
            session_id = '$session_id'
    ";


    //session_unset();

    if($r = $this->db->executeQuery($sql)){
        if(session_destroy()){
            unset($session_id); 
            echo 'Booking successfull';
        }
    }
}

Answer 1

使用 session_regenerate_id(true)生成一个新的 session ID 并删除旧的。请注意，这会将 $_SESSION 中的所有信息保留为新 session ID 的一部分。

例如获取新的 session ID，但将 session 信息保存在 $_SESSION 中。

// Regenerate session ID, user gets a new sid, and cookie is updated.
session_regenerate_id(true);

// Make sure you pick up the new session ID
$session_id = session_id();

// Note, $_SESSION will be the same here as before, but $session_id will be diff.
// Old session info has been moved to new session.

如果您也不想将信息保留在 $_SESSION 中，那么您想使用 session_destroy()销毁服务器端的 session 信息，setcookie()在客户端手动取消设置 session ID cookie。然后您可以像以前一样开始一个新 session 并生成一个新的 session ID。

例如获取新的 session_id 并删除所有 session 信息。

session_unset();   // Remove the $_SESSION variable information.
session_destroy(); // Remove the server-side session information.

// Unset the cookie on the client-side.
setcookie("PHPSESSID", "", 1); // Force the cookie to expire.

// Start a new session
session_start();

// Generate a new session ID
session_regenerate_id(true);

// Then finally, make sure you pick up the new session ID
$session_id = session_id();

// $_SESSION will now be empty, and $session_id will have been regenerated.
// You have a completely empty, new session.

(你可以在没有 setcookie() 调用的情况下离开这里，因为无论如何你正在创建一个新 session ，所以 cookie 将被新 ID 覆盖，但这很好练习显式销毁旧 cookie)。

---

session_destroy() 单独不会删除客户端cookie，因此下次用户访问时，他们仍然会设置相同的 session ID(但他们的服务器端 session 信息将被销毁)。

来自文档(重点是我的):

session_destroy() destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. ... In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted.