session_regenerate_id
Gives the session a new identifier, keeping the data.
Syntax
session_regenerate_id(bool $delete_old_session = false): boolParameters
| Parameter | Type | Description |
|---|---|---|
| $delete_old_session | bool | Optional. Delete the old session file. |
Return value
bool`true` on success.
Examples
After a successful login:
<?php
session_start();
// the password has been verified
session_regenerate_id(true);
$_SESSION['user_id'] = 42;Notes
Changing the identifier on login protects against an attack where the attacker plants a session identifier they already know.
See also
- session_start — Starts a session or resumes the existing one.
- session_destroy — Deletes the session data on the server.
- password_verify — Checks whether a password matches a hash.
Related recipes
In the tutorial
- Registration and login — How to build registration and login in PHP — the users table, password hashing, checking on login, the session, protected pages and logout.