try header_remove( Set-Cookie );

From session_destroy:

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

Does this code work?

setcookie("PHPSESSID",  foo , time()-3600);  /* expired 1 hour ago */

Another solution would be to serve the image through a PHP file, so whenever it gets requested, you can update your database and set a flag to your subscriber table that the newsletter was opened. Much cleaner solution IMHO. You would embed the image with code like this:

<img src="http://www.example.com/tracker.php?idhash=1234234"/>

where idhash could be a combination of subscriber ID plus newsletter ID.

Can you increase the length of the sessions so they don t expire when the user closes thier browser? Set a session variable on the first time the image is loaded by the user. This way it doesn t matter if the image was requested multiple times. You only update the db when the variable isn t set.

Are you sure the image is requested because of the session cookie, and not simply because the E-Mail client for some reason doesn t do any caching?

How about conditionally changing the session cookie name with session_name() depending on the url that s requested?

Try this:

header( Pragma: ,true);

PHP will not send a set cookie header the first time that you start your session.

PHP will set the pragma: nocache header if your session_cache_limiter() is set to private when the session is started. If allowing the cache is all you want, call

session_cache_limiter( public )

before you call session_start(). It must be before session_start(), which means that if your php environment is set to autostart the session, then you have to set session.cache_limiter = public in your php.ini.

If PHP is sending the set cookie header, then one of four things is happening.

1) The session is being started multiple times.

no source - but a one-line PHP program will verify this for you.

session_start();        //  <-- cookie is not sent
session_start();        //  <-- does not count as a second start, nothing happens

session_start();        //  <-- cookie is not sent
session_write_close();  // session_destroy() counts as well
session_start();        //  <-- cookie is sent, since the session has been closed

Check your request and response headers. If the phpsessid value is the same in the response as it is in the request, then this probably is what is happening.

2) The session is being regenerated after it is started

PHP.NET - session_regenerate_id() - Changelog for 4.3.3

session_regenerate_id();

Check your request and response headers. If they are different, then this is probably what is happening.

3) The sessionid is being set prior to the session being started

PHP.NET - session_id - Parameters

session_id( whatever );
session_start();

This one is easy to check for. If you see a call to session_id anywhere in your code, then it s either: before a call to session_start, and is the problem; or it s after a call to session_start, and it does nothing.

4) setcookie( session_name() , ... , ... ) is being called, setting the cookie manually somewhere

No Source

setcookie(session_name(), a session id )
// or setcookie( PHPSESSID ,  a session id )

This one is also easy to check for. Look for any instances of setcookie.

your question isnt really clear, but if you want to remove the PHP session cookie completely (on log-out for example), you can use

  $params = session_get_cookie_params();
  setcookie(session_name(),   , 0, $params[ path ], $params[ domain ], $params[ secure ], isset($params[ httponly ]));