Hello
``` By itself, the **session\_start()** function doesn't add much functionality to a web page. You need to use PHP session variables to really tap into the potential of PHP sessions. For more information about the **session\_start()** function, please visit [http://www.php.net/manual/en/function.session-start.php](http://www.php.net/manual/en/function.session-start.php). ## Working with session variables The **\$\_SESSION** associative array allows you to store session data in variables. For example, suppose you want to implement a very simple hit counter for a page. You can't do this with a generic HTML page. With PHP sessions, though, it's easy. The following code sample demonstrates one way to do this: ```php theme={null}You have visited this page times.
``` In this example, we define a variable named **hits** that is stored in the **\$\_SESSION** array. Each time the page is loaded, the **hits** value increases by one. It is easy to add additional PHP session variables to the **\$\_SESSION** array. All you have to do is reference the variable name you want to use, and PHP takes care of the rest, tracking its value across multiple HTTP connections. For more information about the **\$\_SESSION** array, please visit [http://www.php.net/manual/en/reserved.variables.session.php](http://www.php.net/manual/en/reserved.variables.session.php). ## Ending a session To end a session, use the **session\_destroy()** function. This function deletes all server-side data for the current session. For example, adding the **session\_destroy()** function to our page counter sample code above wouldn't make much sense, because the value of the **hits** variable would be destroyed every time the page is loaded. (The page would always display "You have visited this page 1 times" no matter how many times you load it.) On the other hand, suppose your site has a shopping cart application. A user adds products to the cart on one page, fills out the order information on another page, and finally checks out. After the user checks out and completes the purchase, you probably want to empty the cart and reset the PHP session variables. The **session\_destroy()** function enables you to do this. For more information about the **session\_destroy()** function, please visit [http://www.php.net/manual/en/function.session-destroy.php](http://www.php.net/manual/en/function.session-destroy.php). ## Session settings in php.ini There are numerous settings available in the *php.ini* file that enable you to configure how sessions function on your web site: * The **session.cookie\_lifetime** setting enables you to control how long a session cookie remains valid. * The **session.auto\_start** setting enables you to start sessions automatically instead of calling the **session\_start()** function explicitly. * Another important option is the **session.save\_path** setting, which enables you to specify where PHP stores session files (by default, they are stored in the server's */tmp* directory, but you may prefer to store them somewhere in your own directory instead). For detailed information about all of the session settings available in the *php.ini* file, please visit [http://www.php.net/manual/en/session.configuration.php](http://www.php.net/manual/en/session.configuration.php). ## Session security There are several security considerations you should keep in mind when working with PHP sessions. For example, you must protect against possible session hijacking and fixation attacks. For more information about PHP session security, please visit [http://www.php.net/manual/en/session.security.php](http://www.php.net/manual/en/session.security.php). ## More information To view the official PHP documentation about sessions, please visit [http://www.php.net/manual/en/book.session.php](http://www.php.net/manual/en/book.session.php). ## Related articles * [Custom php.ini files](/docs/custom-php-ini-files)