To handle session properly, take a look at http://php.net/manual/en/session.configuration.php.
There you’ll find these variables:
- session.gc_probability
- session.gc_divisor
- session.gc_maxlifetime
These control the garbage collector (GC) probability of running with each page request.
You could set those with ini_set() at the beginning of your script or .htaccess file so you get certainty to some extent they will get deleted sometime.