PHP Session data lost after submitting form but only on production environment, test environment works -

so have test environment i'm developing , production environment deploying code to. code have right works on test environment not on production environment. seems environment problem, if have no idea setting change.

right i'm trying test simple contact page has short form , captcha image. contact page sets session variable containing security_code displayed in captcha image on next page, called contactsanitize, can read variable session , verify user entered right code.

again, works fine on test environment. however, in production environment can fill out form , submit @ point session data lost , contactsanitize page sends me contact page because doesn't see code entered.

i not have session_destroy call anywhere in these pages , i'm not accidentally setting $_session variable empty array or else matter (i double , triple checked - works on test env, can't that)

below snippets log - each line contains timestamp and, if available, session id in addition comments. can see in fact contactsanitize have same session id it's session empty reason.

this contact.php page:

debug  2013-04-04 18:23:07 (varsandsecuritycheck.php:74) page requires security, checking see if authenticated user. debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:07 (varsandsecuritycheck.php:82) authenticated = false debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:09 (contact.php:130) before security image debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:09 (contact.php:134) invoking security image functions debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:09 (captchasecurityimages.php:42) code: hwjdtvw7 debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:09 (contact.php:137) after security image functions, session: array (     [security_code] => hwjdtvw7 ) debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:09 (contact.php:152) after security image 

i submit form , go contactsanitize.php validate user input:

debug  2013-04-04 18:23:24 (varsandsecuritycheck.php:74) page requires security, checking see if authenticated user. debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:24 (varsandsecuritycheck.php:82) authenticated = false debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:26 (contactsanitize.php:8) session: array ( ) 

as can see above session empty validation fails:

debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:26 (contactsanitize.php:26) no security code , not authenticated, sending contact page. debug  2013-04-04 18:23:26 (varsandsecuritycheck.php:74) page requires security, checking see if authenticated user. debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:26 (varsandsecuritycheck.php:82) authenticated = false 

i sent contact.php page new security code generated:

debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:29 (contact.php:130) before security image debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:29 (contact.php:134) invoking security image functions debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:29 (captchasecurityimages.php:42) code: xb66q6jy debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:29 (contact.php:137) after security image functions, session: array (     [security_code] => xb66q6jy ) debug c744b62f483d1eb02fafbbd11f9e9bdb 2013-04-04 18:23:29 (contact.php:152) after security image 

edit

i added additional logging show session_start call happens @ beginning of both pages. following lines appear @ beginning of contact , contactsanitize pages:

debug  2013-04-04 19:26:15 (varsandsecuritycheck.php:74) page requires security, checking see if authenticated user. debug  2013-04-04 19:26:15 (varsandsecuritycheck.php:78) page secure, starting session now. 

this small snippet varsandsecuritycheck.php page show log comes says "starting session":

$log->debug("page secure, starting session now."); session_start(); 

the following relevant parts of code contact.php:

<?php     ...     //session started first include when secure connection verified     include_once "../includes/varsandsecuritycheck.php";     //this connects database, no session manipulation here     include_once "../includes/dbconnect.php";     //this includes functions generating captcha image     include_once "../captcha/captchasecurityimages.php";      //this including basic styling , navigation       include '../includes/header.php'; ?> ...     <form method="post" action="contactsanitize.php">     ...             $log->debug("just before security image");         ?>             <div class="centertext">                 <?php                     $log->debug("invoking security image functions");                     $_session['security_code'] = generatecode(8);                     $log->debug("after security image functions, session: ".print_r($_session,true));                 ?>                   <?=captchasecurityimages($_session['security_code'],320,70)?>              </div>             ...             <div class="centertext">                 <input id="security_code" name="security_code" type="text" maxlength="8" />                 <br><br>                 <input type="submit" name="submit" value="send message" class='generalformbutton' />             </div>         <?             $log->debug("just after security image");         }          ?> 

this first part of contactsanitize page, can see fails @ first condition:

<?php  //this starts session when secure connection made include_once "../includes/varsandsecuritycheck.php"; //this connects database, no session manipulation here include_once "../includes/dbconnect.php"; //this includes e-mail functions, no session manipulation include_once '../includes/mail.php';  $log->debug("session: ".print_r($_session,true));   $_session['formdata'] = array('visitor_name' => $_post['visitor_name'],                 'visitor_email' => $_post['visitor_email'],                 'reasonforcontacting' => $_post['reasonforcontacting'],                 'message_body' => $_post['message_body']             );  if(!isset($_session['security_code']) && !$authenticated) {     $log->debug("no security code , not authenticated, sending contact page.");     $_session['contacterror'] = "you must type security code before sending message.";     header("location: contact.php");     exit(); } ... 

as per last comment "session save path" not correctly set , has been corrected hosting provider.