session_create_id()

session_create_id() — Create new session id.

Built-in function of PHP 8.5. The manual lists it as available in PHP 7 >= 7.1.0, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

session_create_id() is used to create new session id for the current session. It returns collision free session id.

Signature

session_create_id(string $prefix = ""): string|false

Parameters

Return value

session_create_id() returns new collision free session id for the current session. If it is used without active session, it omits collision check. On failure, false is returned.

Example

A runnable snippet:

// My session start function support timestamp management function my_session_start() { session_start(); // Do not allow to use too old session ID if (!empty($_SESSION['deleted_time']) && $_SESSION['deleted_time'] < time() - 180) { session_destroy(); session_start(); } } // My session regenerate id function function my_session_regenerate_id() { // Call session_create_id() while session is active to // make sure collision free. if (session_status() != PHP_SESSION_ACTIVE) { session_start(); } // WARNING: Never use confidential strings for prefix! $newid = session_create_id('myprefix-'); // Set deleted timestamp. Session data must not be deleted immediately for reasons. $_SESSION['deleted_time'] = time(); // Finish session session_commit(); // Make sure to accept user defined session ID // NOTE: You must enable use_strict_mode for normal operations. ini_set('session.use_strict_mode', 0); // Set new custom session ID session_id($newid); // Start with custom session ID session_start(); } // Make sure use_strict_mode is enabled. // use_strict_mode is mandatory for security reasons. ini_set('session.use_strict_mode', 1); my_session_start(); // Session ID must be regenerated when // - User logged in // - User logged out // - Certain period has passed my_session_regenerate_id(); // Write useful codes

See also

session_regenerate_id(), session_start()

All PHP 8.5 built-in functions

Reference card built from the PHP manual page session_create_id() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.