This code produces html that doesn't pass the w3c code validator:

    <form method=post action="Start.php?login">
    <p>
    Name:<br />
    <input type="text" size=8 maxlength=8 name="name" value="$user"> <br />
    Password:<br />
    <input type="password" size=8 maxlength=8 name="password" value="$pw><br />
    <br />
    <input type='submit' value='Log In'> <br />
    </p>
    </form>

The output code is:
    <form method="post" action="Start.php?login"><input type="hidden" name="PHPSESSID" value="c7d63b0826c43760e36c24ee481970a1">
    <p>
    Name:<br>
    <input type="text" size="8" maxlength="8" name="name" value="xxxxxx"> <br>
    Password:<br>
    <input type="password" size="8" maxlength="8" name="password" value="yyyyyyy"><br>
    <br>
    <input type="submit" value="Log In"> <br>
    </p>
    </form>
(name and password values bogus).

Obviously the problem is the hidden input emitted by php to handle the sessions variables which html4 required to be after the <p> tag.

This "bug" has no effect that I can detect.