UPDATE ON THE PROBLEM:
First thing you have to understand that you cannot delete the COOKIES
on client systems by any means. When you invalid then browser doesn't delete it, but makes the cookie unvalid. The cookie is still there on the clients system. But the browser just ignores it. In order to delete it the client must do it themselves.
To invalid all sessions you can use
session_start(); // initialize session
session_destroy(); // destroy session
setcookie("PHPSESSID","",time()-3600,"/"); // delete session cookie
or javascript code:
document.cookie = "PHPSESSID=; expires=Thu, 01 Jan 1970 00:00:00
UTC;path=/;host=localhost";
In every case you can't delete cookie set by browser's. As PHP and javascript can only issue commands only to invalid the already set cookies present.
By the client himself.
Direction to flush cookies and cache
Uninstall the browser and then Re-Install it.
Create a new php script and insert it on the top of login.php and in this script you check whether there are two PHPSessionId and if there are two then destroy all of them and reload the page. Until you reload the last cookie used before any event would be in-session. You must reload the page or redirect use:
Removing two PHPSESSID
count=0;
foreach($_COOKIE as $key => $value){
if ( $key == "PHPSESSID" ){
count++;
}
}
if (count>1){
//Destory all cookies here
foreach($_COOKIE as $key => $value){
setcookie($key,"",time()-3600,"/");
}
//Reload/redirect the current page to dispose of all things
header("Locations:" . $your_url);
exit(0);
}
Now there would be only I session of PHPSESSID in every case