title: PHP $_SESSION variable will not unset
body: <p>sorry for a repetitive question, I've seen a few of these on this forum but none of the responses worked for me...</p>
  
  <p>I am building a basic login using php sessions, which I'm new at...</p>
  
  <p>login.php validates html login form and begins a session, setting variables: <code>$_SESSION['login']</code> and <code>$_SESSION['id]</code>,</p>
  
  <p>then each page that requires a valid login uses <code>require 'session.php';</code> which checks the <code>$_SESSION['valid']</code> variable and redirects a user w/o proper login variable. The problem is when I logout neither session variable I've set will unset. </p>
  
  <p>Right now my logout.php file uses about every method to destroy the variables that I've been able to find online and none will actually do it.</p>
  
  <p>So whenever I log out, I can still access the 'private' pages.</p>
  
  <p>Also note: I have tried it w/o a session name ex: <code>session_start();</code> that didn't work so now I'm using <code>session_start("user");</code></p>
  
  <p>Also note: I am NOT using cookies.</p>
  
  <p>Here are the files I mentioned:</p>
  
  <hr>
  
  <p>login.php</p>
  
  <hr>
  
  <pre><code>$email=$_POST['email-log']; $pass=$_POST['password-log'];
  
  $i=-1;
  
  do
  {$i++; $path="users/".$i.".json";
  $file=  file_get_contents($path);
  $x=json_decode($file,true);
  } while($x['email']!=$email);
  $id=$i;
  $truepass=$x['pass'];
  
  $errors=0;
  $hash=hash('sha256',$pass);
  if($hash != $truepass){$errors=$errors+1;}
  
  if($errors==0){
          session_start("user");
          $_SESSION['login']="valid";
          $_SESSION['id']=$id;
  
      header('Location: loginlanding.php');}
  
  else{header('Location: front.php?error=y');}
  </code></pre>
  
  <hr>
  
  <p>session.php</p>
  
  <hr>
  
  <pre><code>session_start("user"); if($_SESSION['login'] !== "valid") {header('Location: front.php?needto=login');}
  </code></pre>
  
  <hr>
  
  <p>logout.php</p>
  
  <hr>
  
  <pre><code>unset($_SESSION); unset($_SESSION['login']); unset($_SESSION['id']); session_unset("user"); $_SESSION=array(); session_destroy("user"); header('Location: front.php?logged=out');
  </code></pre>
  
  <hr>
  
  <p>Any and all responses are welcome and I thank you in advance, also note, I am new to logins in general so any advice to beef up security is welcome also. I'm planning on making it more secure, but first I need to get this basic functionality up and running.</p>