Php redirect based on value not working?

Question

Hello, i have a signup page, a login page, failed.php and a landing page once they have signed up.
the user signs up (application-formP1.php) then once they have done this they are redirected to the next page (application-formP2.php) they then have other information to add.
on application-formP1.php there is a redirect that if the user has finished with the page (completed it) they are directed to application-formP2.php
if($status == "P1complete")
          header("location: application-formP2.php");
the trouble i am having is if i just try to access application-formP1.php ( which is the signup page) it is automatically sending the user to application-formP2.php even if they are not signed in then because they are not signed in it is sending the user to the failed page (obiously because the retstrict user is working)
i have included the code below for application-formP1.php
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
  $insertSQL = sprintf("INSERT INTO LettingsTenApp (tenID, progress, tenTitle, tenUsername, tenPassword, tenSex, tenEmail, tenDobDD, tenDobMM, tenDobYY, tenDepend, tenMarital, tenPrevSurn, tenEmployTyp, tenNINumber) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['tenID'], "int"),
                                                     GetSQLValueString($_POST['progress'], "text"),
                       GetSQLValueString($_POST['tenTitle'], "text"),
                       GetSQLValueString($_POST['tenUsername'], "text"),
                       GetSQLValueString($_POST['tenPassword'], "text"),
                       GetSQLValueString($_POST['tenSex'], "text"),
                       GetSQLValueString($_POST['tenEmail'], "text"),
                       GetSQLValueString($_POST['tenDobDD'], "text"),
                       GetSQLValueString($_POST['tenDobMM'], "text"),
                       GetSQLValueString($_POST['tenDobYY'], "text"),
                       GetSQLValueString($_POST['tenDepend'], "text"),
                       GetSQLValueString($_POST['tenMarital'], "text"),
                       GetSQLValueString($_POST['tenPrevSurn'], "text"),
                       GetSQLValueString($_POST['tenEmployTyp'], "text"),
                       GetSQLValueString($_POST['tenNINumber'], "text"));
  mysql_select_db($database_Letting, $Letting);
  $Result1 = mysql_query($insertSQL, $Letting) or die(mysql_error());
  $insertGoTo = "application-formP2.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  header(sprintf("Location: %s", $insertGoTo));
mysql_select_db($database_Letting, $Letting);
$query_rsTenant = "SELECT * FROM LettingsTenApp";
$rsTenant = mysql_query($query_rsTenant, $Letting) or die(mysql_error());
$row_rsTenant = mysql_fetch_assoc($rsTenant);
$totalRows_rsTenant = mysql_num_rows($rsTenant);
$status = $row_rsTenant['progress'];
// Redirect user if thier application is completed
if($status == "P1complete")
          header("location: application-formP2.php");
and the form
<form action="<?php echo $editFormAction; ?>" method="post" name="form1" >
        <input type="submit" value="Save &amp; continue" />
        <input type="hidden" name="progress" value="P1complete" />
        <input type="hidden" name="MM_insert" value="form1" />
</form>
thanks

Answer 1

i noticed i dint have the session variable on the form i have now included this
<?php
if (!isset($_SESSION)) {
  session_start();
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";
// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) {
  // For security, start by assuming the visitor is NOT authorized.
  $isValid = False;
  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username.
  // Therefore, we know that a user is NOT logged in if that Session variable is blank.
  if (!empty($UserName)) {
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login.
    // Parse the strings into arrays.
    $arrUsers = Explode(",", $strUsers);
    $arrGroups = Explode(",", $strGroups);
    if (in_array($UserName, $arrUsers)) {
      $isValid = true;
    // Or, you may restrict access to only certain users based on their username.
    if (in_array($UserGroup, $arrGroups)) {
      $isValid = true;
    if (($strUsers == "") && true) {
      $isValid = true;
  return $isValid;
$MM_restrictGoTo = "failed.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {  
  $MM_qsChar = "?";
  $MM_referrer = $_SERVER['PHP_SELF'];
  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0)
  $MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo);
  exit;
?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  return $theValue;
$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
  $insertSQL = sprintf("INSERT INTO hostLettingsTenApp (tenID, progress, tenTitle, tenUsername, tenPassword, tenSex, tenEmail, tenDobDD, tenDobMM, tenDobYY, tenDepend, tenMarital, tenPrevSurn, tenEmployTyp, tenNINumber) VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['tenID'], "int"),
                                                     GetSQLValueString($_POST['progress'], "text"),
                       GetSQLValueString($_POST['tenTitle'], "text"),
                       GetSQLValueString($_POST['tenUsername'], "text"),
                       GetSQLValueString($_POST['tenPassword'], "text"),
                       GetSQLValueString($_POST['tenSex'], "text"),
                       GetSQLValueString($_POST['tenEmail'], "text"),
                       GetSQLValueString($_POST['tenDobDD'], "text"),
                       GetSQLValueString($_POST['tenDobMM'], "text"),
                       GetSQLValueString($_POST['tenDobYY'], "text"),
                       GetSQLValueString($_POST['tenDepend'], "text"),
                       GetSQLValueString($_POST['tenMarital'], "text"),
                       GetSQLValueString($_POST['tenPrevSurn'], "text"),
                       GetSQLValueString($_POST['tenEmployTyp'], "text"),
                       GetSQLValueString($_POST['tenNINumber'], "text"));
  mysql_select_db($database_hostLetting, $hostLetting);
  $Result1 = mysql_query($insertSQL, $hostLetting) or die(mysql_error());
  $insertGoTo = "application-formP2.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  header(sprintf("Location: %s", $insertGoTo));
$colname_rsTenant = "-1";
if (isset($_POST['P1complete'])) {
  $colname_rsTenant = $_POST['P1complete'];
mysql_select_db($database_hostLetting, $hostLetting);
$query_rsTenant = sprintf("SELECT progress FROM hostLettingsTenApp WHERE tenID = %s", GetSQLValueString($colname_rsTenant, "int"));
$rsTenant = mysql_query($query_rsTenant, $hostLetting) or die(mysql_error());
$row_rsTenant = mysql_fetch_assoc($rsTenant);
$totalRows_rsTenant = mysql_num_rows($rsTenant);
$status = $row_rsTenant['progress'];
// Redirect user if thier application is completed
if($status == "P1complete")
          header("location: application-formP2.php");
?>
but it still is staying on this page if the column "progress" has "P1complete " in it