Unset a specefic session using session id

问题

I am the admin of the the site.I want unset a particular session, i know its session id

The users just stating the session like this

session_id("usernumber");
session_start();

Let say user A has usernumber "123" i want to destroy all the values of the user A , user A will not regenerate the sessio_id() after setting that as session_id("123");

How can i unset destroy only for user A.?

回答1:

Without reverse enginering the session handler....

<?php

session_id($_GET['killsid']);
session_start();
session_destroy() || die "failed to kill";

回答2:

Answer by Jack Luo on php.net

$session_id_to_destroy = 'nill2if998vhplq9f3pj08vjb1';
// 1. commit session if it's started.
if (session_id()) {
    session_commit();
}

// 2. store current session id
session_start();
$current_session_id = session_id();
session_commit();

// 3. hijack then destroy session specified.
session_id($session_id_to_destroy);
session_start();
session_destroy();
session_commit();

// 4. restore current session id. If don't restore it, your current session will refer     to the session you just destroyed!
session_id($current_session_id);
session_start();
session_commit();

回答3:

You could try to get session_save_path() (in this directory session files are stored). When you are using default session names the filename looks like sess_jgimlf5edugvdtlaisumq0ham5 where jgimlf5edugvdtlaisumq0ham5 is user session id so you can just unlink this file unless you dont have permissions to edit those files.

回答4:

As far as I know, the only supported way to do so with the default session handler is to impersonate the user with session_id("usernumber"); and then remove the values.

You could also store sessions in a database, which would make this all pretty straightforward, yet you need to write your own session handling code.

BTW, the session ID is supposed to be a long random string which you cannot guess. Using 123 means that any anonymous visitor can easily log in with any user credentials.

来源：https://stackoverflow.com/questions/6703842/unset-a-specefic-session-using-session-id