it looks fine to me. but i want to share one bad experience with sessions. the code i wrote work just fine on my testing server (please note, the phpinfo is same with my production server). after days of figuring out why the session do not work. finally, i found the solutions. the solutions is to add a @session_write_close() on the end of the execution code. on my case it happen every time i forward the page. so adding the @session_write_close before the header('location: xxxx') fix the problem. this might be a possible explanation..