Ytdyklly

I was wondering is this a proper way to use $_SESSION. My code is working fine, but I read a lot about how use of $_SESSION should be avoided, and how it's usage can make security holes in code, so I wanted to double-check my code here.

1. In the beginning of the file, I am doing session_start();


2. In the second step, I am getting array data from AJAX call, and saving it in $_SESSION variable


3. In the third step, I am using data I added to $_SESSION variable in previous step, and doing unset on it in the end


4. In the last step, I am doing session_destroy();

This is how it looks:

<?php

session_start();





if ( !class_exists( 'TBYB_public' ) ) {

class TBYB_public

{



    public static function on_load()

    {

        add_action('plugins_loaded', array(__CLASS__, 'init'));

    }





    public static function init()

    {



        /* I am adding array data here to $_SESSION variable */

        add_action('wp_ajax_return_reason', array(__CLASS__, 'select_return_reason'));



        /* I am using data I added to $_SESSION variable in previous step, and doing unset on it in the end */

        add_filter('woocommerce_get_cart_item_from_session', array(__CLASS__, 'update_cart_items_data'), 10, 3);



        /* I am doing session_destroy(); here */

        add_action('woocommerce_add_order_item_meta', array(__CLASS__, 'save_in_order_item_meta'), 10, 3);





    /*

     * Catch return reason sent by AJAX and save it to php session variable

     * */

    public static function select_return_reason()

    {



        $i = 0;

        $return_reasons = array();

        $cart_items = WC()->cart->get_cart();



        foreach ($cart_items as $cart_item_key => $cart_item) {



            array_push($return_reasons, tbyb_prepare($_POST[$cart_item_key]));



            foreach ($return_reasons as $reason_key => $return_reason) {

                if ($i == $reason_key) {

                    if (!$return_reason == '') {

                        $item_id = $cart_item['key'];

                        $_SESSION += [$item_id => $return_reason];

                    }

                }

            }

            $i++;

        }

        wp_die();

    }







    /*

     * Update cart items data

     * */

    public static function update_cart_items_data($item, $cart_item, $key)

    {

        if (isset($_SESSION[$key])) {

            $item['return_data']['label'] = "<span class='tbyb-returned'>RETURNED</span> - Reason";

            $item['return_data']['value'] = $_SESSION[$key];

            unset($_SESSION[$key]);

        }

        return $item;

    }







    /*

     * Save item custom fields label and value as order item meta data

     * */

    public static function save_in_order_item_meta($item_id, $values, $cart_item_key)

    {

        if (isset($values['return_data']) && ($values['return_data']['value'] !== 'Keep')) {

            wc_add_order_item_meta($item_id, $values['return_data']['label'], $values['return_data']['value']);

        }



        session_destroy();

    }





}

}

I was wondering is this a proper way to use $_SESSION in this WordPress/PHP/AJAX situation, and if not, what would be the better solution for this?