Securely creating and destroying login sessions in PHP

Question

This is my code to control authentication on a website. I\'m not sure if my logic is correct. If the username and password are correct the following happen:

Answer 1

You can first use session_id() to determine whether the user already got a session, if not, then use session_start().

example codes from Lithium framewrok:

/**
 * Starts the session.
 *
 * @return boolean True if session successfully started (or has already been started),
 *         false otherwise.
 */
protected static function _start() {
    if (session_id()) {
        return true;
    }
    ...
    return session_start();
}

After call _start(), you can safely call session_destroy()