session_regenerate_id()

session_regenerate_id() — Update the current session id with a newly generated one.

Built-in function of PHP 8.5. The manual lists it as available in PHP 4 >= 4.3.2, PHP 5, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

session_regenerate_id() will replace the current session id with a new one, and keep the current session information.

Signature

session_regenerate_id(bool $delete_old_session = false): bool

Parameters

Parameter	Type	What it takes
$delete_old_session	bool	Whether to delete the old associated session file or not. You should not delete old session if you need to avoid races caused by deletion or detect/avoid session hijack attacks.

Return value

Returns true on success or false on failure.

Example

A runnable snippet:

// NOTE: This code is not fully working code, but an example! session_start(); // Check destroyed time-stamp if (isset($_SESSION['destroyed']) && $_SESSION['destroyed'] < time() - 300) { // Should not happen usually. This could be attack or due to unstable network. // Remove all authentication status of this users session. remove_all_authentication_flag_from_active_sessions($_SESSION['userid']); throw(new DestroyedSessionAccessException); } $old_sessionid = session_id(); // Set destroyed timestamp $_SESSION['destroyed'] = time(); // session_regenerate_id() saves old session data // Simply calling session_regenerate_id() may result in lost session, etc. // See next example. session_regenerate_id(); // New session does not need destroyed timestamp unset($_SESSION['destroyed']); $new_sessionid = session_id(); echo "Old Session: $old_sessionid<br />"; echo "New Session: $new_sessionid<br />"; print_r($_SESSION);