PHP - How Secure Is $_session?

First let me explain my code.
It comprises of three php files.

 project_status.php:

<?php
 include 'inc_fn_header_and_menu.php';
function includeFile($file,$variable) {
    $var = $variable;
    include($file);
}
if (isset($_GET['id']) && $_GET['id']!="") {
    $pid    = $_GET['id'];
    $_SESSION['pidForApproval'] = $_GET['id'];
    $query = 'SELECT * FROM `profile` WHERE pid ='.'\''.$pid.'\'';
    $result=mysqli_query($db,$queryToRetrievePP) or die("There are no records to display ... \n" . mysqli_error());
    foreach ($result as $row) {
        $status = $row['status'];
    }        
}
...........some PHP and HTML code.......
	<div id="customerPurchaseApprovalForm">
<?php  
  echo '<p>APPROVAL FOR CUSTOMER PURCHASE</p>';
  $discountApprovalStatus = "Granted";
  if ($discountApprovalStatus == "Granted") {  
 
  includeFile("project_status_app.php",$highestannualvalue);
  } else {
     //.........
  }

In project_status_app.php I am attempting to retrieve pidForApproval from the $_SESSION array.

<?php
        // put your code here  UPDATE `pp` SET `customer_purchase_remarks` = 'hahaha' WHERE `pp`.`id` = 207;
        
        if ($_SERVER['REQUEST_METHOD'] == 'POST') {
            include '../../inc/fastlogin.php';      
            $sql = "UPDATE pp SET customer_purchase_remarks ='{$_POST['remarkstxt']}' WHERE pp.pid='{$_SESSION['pidForApproval']}'"; 
            $result = mysqli_query ( $fastdb, $sql ) ;
            if (mysqli_affected_rows($fastdb) != 1) { 
               $_SESSION['err_cpa_rmks'] = "<p>Error while updating WHERE id='{$_SESSION['pidForApproval']}'</p>";
                //echo "<p>Error while updating WHERE id='{$_POST['pidForApproval']}'</p>".mysqli_error($fastdb);                 
            } else { 
                $_SESSION['suc_cpa_rmks'] = "<p>Records was updated successfully.</p>";
                //echo "Records was updated successfully."; 
            }
            header ("location: project_status.php?id="$_SESSION['pidForApproval']);
            exit();
        }    
        
        ?>

When I load  project_status.php,  project_status_app.php is supposed to display the form. Once the user fills in the form the and the submit button has been pressed, the UPDATE statement is supposed to run and then it is supposed to navigate back to project_status.php?id=FA142. But the update is failing and the when the project_status.php is loaded back, the url looks like this http://localhost/fast/project_status.php?id= . The id is empty. It is supposed to be something like this http://localhost/fast/project_status.php?id=FA142. With the id being populated at the 

header ("location: project_status.php?id=".$_SESSION['pidForApproval']);

I suspected that my $_SESSION['pidForApproval'] is not being populated in project_status.php but I echoed back $_SESSION['pidForApproval'] in that file itself and I can see it is being populated. Hence, I suspect that the $_SESSION['pidForApproval'] is not being passed to project_status_app.php. I have already attempted to include session_start(); clause in project_status_app.php but that gives an error, stating that the session has already started, in inc_fn_header_and_menu.php. Can someone help me as to why the $_SESSION['pidForApproval'] is not being passed on to the project_status_app.php file. Thank you.

<form name= "finalForm" method="POST" action="cart.php">
<input type="Submit" name="finalSelected"/>

<?php foreach($FinalName as $key => $item) {?>
<tr>
<td><input type="checkbox" name="fSelected[]" value="<?php echo htmlspecialchars($FinalID[$key])?>" />
<?php echo "$FinalID[$key] & $item";?>
</td>
</tr>
<?php } ;?>

<?php
require ('connect_db.php');
if(isset($_POST['finalSelected']))
{
	if(!empty($_POST['fSelected']))
	{
		$chosen = $_POST['fSelected'];
		foreach ($chosen as $item)
			echo "aID selected: $item </br>";
		$delimit = implode(", ", $chosen);
		print_r($delimit);
	}

}
if(isset($delimit))
{
$cartSQL = "SELECT * from article where aID in ($delimit)";
$cartQuery = mysqli_query($dbc, $cartSQL) or die (mysqli_error($dbc));
while($row = mysqli_fetch_array($cartQuery, MYSQLI_BOTH))
{
	$aTitle[] = $row[ 'name' ];
}
}
?>

<table>
	
		<?php if(isset($delimit)) { 
		$c=0; foreach($aTitle as $item) {?>
		<tr>
		<td>
			<?php echo $aTitle[$c]; $c++;?>
		</td>
		</tr>
		<?php }}?>
</table>

<div id="image-upload">
<h2>Upload your image</h2>
<form action="upload.php" method="post" enctype="multipart/form-data"> 
Upload:<br><br> 
<input type="file" name="image"><br><br>
Image Title:<br><br> 
<input type="text" name="image_title"><br><br> 
<input type="submit" name="submit" value="Upload"> 
</form>
	
	
<?php
include("upload_file.php");

function GetImageExtension($imagetype)
{
if(empty($imagetype)) return false;
switch($imagetype)
{
case 'image/bmp': return '.bmp';
case 'image/jpeg': return '.jpg';
case 'image/png': return '.png';
default: return false;
}
}
		 
			 
if ($_FILES['image']['error'] !== UPLOAD_ERR_OK) {
die();
}

$extension = getimagesize($_FILES['image']['tmp_name']);
if ($extension === FALSE) {
die("<br><font color='#8B0000'>Unable to determine image typeof uploaded file</font>");
}

if (($extension[2] !== IMAGETYPE_GIF) && ($extension[2] !== IMAGETYPE_JPEG) && ($extension[2] !== IMAGETYPE_PNG)) {
die("<br><font color='#8B0000'>Only images are allowed!</font>");
}
			 
			 
			 			 
if (!empty($_FILES["image"]["name"])) {

$file_name=$_FILES["image"]["name"];
$temp_name=$_FILES["image"]["tmp_name"];
$imgtype=$_FILES["image"]["type"];
$ext= GetImageExtension($imgtype);
$imagename=$_FILES["image"]["name"];
$target_path = "../../images/upload/".$imagename;
$title = $_POST["image_title"];

		
if(move_uploaded_file($temp_name, $target_path)) {
$query_upload="INSERT into `images_tbl` (`images_path`,`submission_date`,`image_title`) VALUES 
('".$target_path."','".date("Y-m-d")."','".$title."')";

mysql_query($query_upload) or die("error in $query_upload == ----> ".mysql_error()); 
echo '<br>Image uploaded!';
}else{
echo '<br><font color="#8B0000">Only images are allowed!</font>';
} 
}
?>