When logging a user out of a website, on the logout page is it nescecary to start the session before destroying it?

Question

In logout.php is all that is needed

session_destroy();

or should it be

session_start();
session_destroy();

I'm concerned that if a user directly navigates to this page there may be an error destroying the session if one hadn't already been created. On the other hand would the session_destroy() destroy the session created in the line above?

Answer 1

You don't need to call session_start() first... session_destroy() will remove a session completely on the server and therefore calling session_start() beforehand may cause extra processing to create a session to only destroy it one line later.

I would advise viewing further details on the man page regarding clearing any associated cookies / session superglobals