By reading up on session_unset() and session_destroy() I've found notes that destroy
does not clean up variables and such.
How come the code below does not clean up the
$_SESSION
superglobal, which it should by its documentation?Is this behavior documented anywhere?
Snippet to reproduce:
#!/usr/bin/php
<?php
session_start();
$_SESSION['x'] = 1;
// If you uncomment this, `session_unset` works as intended.
session_destroy();
// It doesn't matter if you call unset, it won't have any effect
// as session_destroy was called.
session_unset();
fwrite(STDERR, var_export($_SESSION, true));
// prints: array ('x' => 1), even though session_unset was called