blocks|key|979609|text|这取决于您的会话存储。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|979610|如果您使用的是PHP会话存储，那么它们可能位于服务器的临时目录中。删除选定的文件将“终止”会话。但是，如果您服务器处于运行状态，则会话文件可能会被HTTP进程占用，您将无法删除它。请看下面的图像。以"%2B~“开头命名的文件都是会话文件。|979611|📷|atomic|offset|length|979612|​|979613|更好的解决方案是使用数据库会话存储，并从那里删除选定的会话。您可以查看具有多个containers的HTTP_Session2。|style|CODE|979614|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/0ea4fd66d06ecf833483b0b43f134384.png|imageAlt|1|LINK|MUTABLE|url|http://pear.php.net/manual/en/package.http.http-session2.database.php|2|http://pear.php.net/package/HTTP_Session2^0|0|0|0|1|0|0|0|1E|D|13|A|1|1E|D|2|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|15|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|16|8|@]|9|@$G|17|H|18|1|19]]|A|$]]|$1|I|3|J|5|6|7|1A|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1B|8|@$G|1C|H|1D|M|N]]|9|@$G|1E|H|1F|1|1G]|$G|1H|H|1I|1|1J]]|A|$]]|$1|O|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V|W|-4]]|X|$5|Y|S|Z|A|$10|11]]|12|$5|Y|S|Z|A|$10|13]]]]

It depends on your session storage.

If you're using PHP session storage, then they may be in the temporary directory of your server. Deleting the selected files will "kill" the session. However if your server is in running state, that session file may be occupied by HTTP process and you won't be able to delete it. Just look at the image below. File named as starting with "+~" are all session files.
<a href="https://i.stack.imgur.com/iQL2t.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iQL2t.png" alt="Screenshot of Session Occupied by Process and could not delete it"></a>

A nicer solution is to use a database session storage and delete the selected sessions from there. You can check out <a href="http://pear.php.net/package/HTTP_Session2" rel="nofollow noreferrer"><code>HTTP_Session2</code></a> which has multiple <a href="http://pear.php.net/manual/en/package.http.http-session2.database.php" rel="nofollow noreferrer">containers</a>.

blocks|key|764262|text|您可以使用session_save_path()找到保存会话文件的路径，然后使用unlink()删除它们。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|764263|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.session-save-path.php|1|http://php.net/manual/en/function.unlink.php^0|5|J|14|8|5|J|0|14|8|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]|$9|S|A|T|B|C]]|D|@$9|U|A|V|1|W]|$9|X|A|Y|1|Z]]|E|$]]|$1|F|3|-4|5|6|7|10|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]|N|$5|I|J|K|E|$L|O]]]]

You can use <a href="http://php.net/manual/en/function.session-save-path.php" rel="noreferrer"><code>session_save_path()</code></a> to find the path where PHP saves the session files, and then delete them using <a href="http://php.net/manual/en/function.unlink.php" rel="noreferrer"><code>unlink()</code></a>.

blocks|key|764337|text|您可以尝试通过执行以下操作强制PHP删除所有会话|type|unstyled|depth|inlineStyleRanges|entityRanges|data|764338|ini_set('session.gc_max_lifetime',+0);
ini_set('session.gc_probability',+1);
ini_set('session.gc_divisor',+1);|code-block|syntax|javascript|764339|这迫使PHP将所有会话视为具有0秒生命周期，并且有100%25被清理的可能性。|764340|缺点是，无论哪个倒霉的用户第一次运行它，都会在PHP进行清理时得到长时间的停顿，特别是在有很多会话文件要处理的情况下。|764341|对于一个特定的用户，您必须向您的会话处理程序添加一些代码：|764342|+if+($_SESSION['username']+==+'user+to+delete')+{
+++++session_destroy();
+}|764343|PHP的垃圾收集器是不可控制的，所以你不能给它参数，比如“删除除用户X之外的所有会话”。它严格查看会话文件上的最后修改/最后访问的时间戳，并将其与max_lifetime设置进行比较。它实际上并不处理会话数据。|764344|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|V|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|W|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|X|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|Y|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

You could try to force PHP to delete all the sessions by doing

<pre><code>ini_set('session.gc_max_lifetime', 0);
ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 1);
</code></pre>

That forces PHP to treat all sessions as having a 0-second lifetime, and a 100% probability of getting cleaned up.

The drawback is that whichever unlucky user runs this first will get a long pause while PHP does cleanup, especially if there's a lot of session files to go through.

For one particular user, you'd have to add some code to your session handler:

<pre><code> if ($_SESSION['username'] == 'user to delete') {
 session_destroy();
 }
</code></pre>

PHP's garbage collector isn't controllable, so you can't give it parameters such as "delete all sessions except for user X's". It looks strictly at the last-modified/last-accessed timestamps on the session files and compares that to the max_lifetime setting. It doesn't actually process the session data.

blocks|key|764608|text|更新-+2012年8月|type|unstyled|depth|inlineStyleRanges|entityRanges|data|764609|这段代码基于official+PHP+site和另一个写得很好的snippet+on+SO。|offset|length|764610|<?php
//+Finds+all+server+sessions
session_start();
//+Stores+in+Array
$_SESSION+=+array();
//+Swipe+via+memory
if+(ini_get("session.use_cookies"))+{
++++//+Prepare+and+swipe+cookies
++++$params+=+session_get_cookie_params();
++++//+clear+cookies+and+sessions
++++setcookie(session_name(),+'',+time()+-+42000,
++++++++$params["path"],+$params["domain"],
++++++++$params["secure"],+$params["httponly"]
++++);
}
//+Just+in+case..+swipe+these+values+too
ini_set('session.gc_max_lifetime',+0);
ini_set('session.gc_probability',+1);
ini_set('session.gc_divisor',+1);
//+Completely+destroy+our+server+sessions..
session_destroy();
?>|code-block|syntax|javascript|764611|效果很好。像NGinx这样的服务器，你可以关闭，清理缓存，滑动内存重置，清除日志等，并通常删除临时使用。甚至可以降低内存的限制。|764612|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.session-destroy.php|1|https://stackoverflow.com/questions/508959/truly-destroying-a-php-session^0|0|6|H|0|W|D|1|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|X|8|@]|9|@$D|Y|E|Z|1|10]|$D|11|E|12|1|13]]|A|$]]|$1|F|3|G|5|H|7|14|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|15|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|16|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]|U|$5|P|Q|R|A|$S|V]]]]

<h1>Updated - Aug 2012</h1>
This code is based from the <a href="http://php.net/manual/en/function.session-destroy.php" rel="nofollow noreferrer">official PHP site</a>, and another well written <a href="https://stackoverflow.com/questions/508959/truly-destroying-a-php-session">snippet on SO</a>.
<pre><code>&lt;?php
// Finds all server sessions
session_start();
// Stores in Array
$_SESSION = array();
// Swipe via memory
if (ini_get(&quot;session.use_cookies&quot;)) {
 // Prepare and swipe cookies
 $params = session_get_cookie_params();
 // clear cookies and sessions
 setcookie(session_name(), '', time() - 42000,
 $params[&quot;path&quot;], $params[&quot;domain&quot;],
 $params[&quot;secure&quot;], $params[&quot;httponly&quot;]
 );
}
// Just in case.. swipe these values too
ini_set('session.gc_max_lifetime', 0);
ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 1);
// Completely destroy our server sessions..
session_destroy();
?&gt;
</code></pre>
Works well. Servers like NGinx you can turn off, clean cache, swipe memory reset, clear logs etc and generally remove temp usage. Even drop the limits of memory.

blocks|key|764655|text|我将创建一个txt文件，其中包含与生成的登录会话具有相同值的令牌，作为每次用户登录时的比较：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|764656|if($_SERVER['REQUEST_METHOD']+==+'POST')+{
++++$token+=+sha1(uniqid(mt_rand(),+true));
++++if($everything_is_valid)+{
++++++++//+Set+login+session
++++++++$_SESSION[$_POST['username']]+=+$token;
++++++++//+Create+token+file
++++++++file_put_contents('log/token.'+.+$_POST['username']+.+'.txt',+$token);
++++++++//+Just+to+be+safe
++++++++chmod('log/token.'+.+$_POST['username']+.+'.txt',+0600);
++++}
}|code-block|syntax|javascript|764657|检查已登录的用户：|764658|if(isset($_SESSION['charlie'])+&&+file_exists('log/token.charlie.txt')+&&+$_SESSION['charlie']+==+file_get_contents('log/token.charlie.txt'))+{
++++echo+'You+are+logged+in.';
}|764659|因此，如果您想强制此charlie用户注销，只需删除令牌文件：|764660|//+Force+logout+the+`charlie`+user
unlink('log/token.charlie.txt');|764661|entityMap^0|6|3|0|0|0|0|A|7|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|Z|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|10|8|@$9|11|A|12|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|S|3|-4|5|6|7|14|8|@]|D|@]|E|$]]]|T|$]]

I will create a <code>txt</code> file containing the token which has the same value as the generated login session as a comparison every time the user is logged in:

<pre><code>if($_SERVER['REQUEST_METHOD'] == 'POST') {
 $token = sha1(uniqid(mt_rand(), true));
 if($everything_is_valid) {
 // Set login session
 $_SESSION[$_POST['username']] = $token;
 // Create token file
 file_put_contents('log/token.' . $_POST['username'] . '.txt', $token);
 // Just to be safe
 chmod('log/token.' . $_POST['username'] . '.txt', 0600);
 }
}
</code></pre>

Checks for logged in user(s):

<pre><code>if(isset($_SESSION['charlie']) &amp;&amp; file_exists('log/token.charlie.txt') &amp;&amp; $_SESSION['charlie'] == file_get_contents('log/token.charlie.txt')) {
 echo 'You are logged in.';
}
</code></pre>

So, if you want to force this <code>charlie</code> user to be logged out, simply remove the token file:

<pre><code>// Force logout the `charlie` user
unlink('log/token.charlie.txt');
</code></pre>

blocks|key|764748|text|陶菲克的答案是我能找到的最好的答案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|764749|但是，您可以对其进行进一步修改|764750|对用户进行身份验证并创建会话变量后，添加以下行：|764751|$token+=+"/sess_"+.+session_id();
file_put_contents('log/'+.+$_SESSION['id']+.+'.txt',+$token);|code-block|syntax|javascript|764752|如果您需要在cronjob期间或通过管理请求强制用户注销：|764753|$path+=+session_save_path();
$file+=+file_get_contents('log/xxx.txt');+//+xxx+is+user's+id
$url+=+$path.$file;
unlink($url);|764754|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|T|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|V|8|@]|9|@]|A|$I|J]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

Taufik's answer is the best i could find. 
However, you can further modify it 
After authenticating the user and creating the session variables, add these lines: 

<pre><code>$token = "/sess_" . session_id();
file_put_contents('log/' . $_SESSION['id'] . '.txt', $token);
</code></pre>

If you need to force the user to log out during a cronjob or by an admin request: 

<pre><code>$path = session_save_path();
$file = file_get_contents('log/xxx.txt'); // xxx is user's id
$url = $path.$file;
unlink($url);
</code></pre>

blocks|key|980120|text|我发现这段代码非常有用，它对我来说真的很有效|type|unstyled|depth|inlineStyleRanges|entityRanges|data|980121|<?php

$path+=+session_save_path();

$files+=+glob($path.'/*');+//+get+all+file+names
foreach($files+as+$file){+//+iterate+files
++if(is_file($file))
++++unlink($file);+//+delete+file
}

?>|code-block|syntax|javascript|980122|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I found this code very helpful and it really worked for me

<pre><code>&lt;?php

$path = session_save_path();

$files = glob($path.'/*'); // get all file names
foreach($files as $file){ // iterate files
 if(is_file($file))
 unlink($file); // delete file
}

?&gt;
</code></pre>

blocks|key|764858|text|删除所有会话变量|type|unstyled|depth|inlineStyleRanges|entityRanges|data|764859|session_unset();|code-block|syntax|javascript|764860|销毁会话|764861|session_destroy();|764862|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

remove all session variables
<pre><code>session_unset();
</code></pre>
destroy the session
<pre><code>session_destroy();
</code></pre>

I have a very basic php session login script. I want to force logout of a certain user or force logout of all users.

How can I read all sessions made to my website, and destroy some or all sessions?

How to kill a/all php sessions?

身份验证

数据库

服务器

我有一个非常基本的php会话登录脚本。我想强制某个用户注销或强制所有用户注销。如何读取网站上的所有会话，并销毁部分或全部会话？

问如何杀死一个/所有的php会话？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何杀死一个/所有的php会话？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何杀死一个/所有的php会话？
EN