PHP/Javascript hjälp med Captcha (sessions problem?)

<?php
include("include/session.php");
?>
<p>Anti-Spamskydd</p>
        <p>
        <img id="imgCaptcha" src="http://mindu.mine.nu/projektarbete/benni/TEST/captcha/create_..." >
        <?php echo $_SESSION["security_code"]; ?>

       <input id="btnCaptcha" type="button" value="Ladda om" name="btnCaptcha" 
onclick="getParam(document.frmCaptcha)" /><br/>
        
        <input type="text" name="captcha" maxlength="30" value="<?php echo $form->value("captcha"); ?>"><?php echo $form->error("captcha"); ?>
        </p> 

<p class="textinput"><input type="hidden" name="subjoin" value="1"><input type="submit" value="Registrera!"></p>

</form>

<?php

//Start the session so we can store what the security code actually is
session_start();

//Set the session to store the security code
$_SESSION["security_code"] = $security_code;

//Send a generated image to the browser 
create_image();
exit(); 

function create_image() 
{ 
global $security_code;

    //Let's generate a totally random string using md5 
    $md5_hash = md5(rand(0,999)); 
    //We don't need a 32 character long string so we trim it down to 5 
    $security_code = substr($md5_hash, 15, 5); 

 
    //Set the image width and height 
    $width = 100; 
    $height = 20;  

    //Create the image resource 
    $image = ImageCreate($width, $height);  

    //We are making three colors, white, black and gray 
    $white = ImageColorAllocate($image, 255, 255, 255); 
    $black = ImageColorAllocate($image, 0, 0, 0); 
    $grey = ImageColorAllocate($image, 204, 204, 204); 

    //Make the background black 
    ImageFill($image, 0, 0, $black); 

    //Add randomly generated string in white to the image
    ImageString($image, 3, 30, 3, $security_code, $white); 
 
    //Tell the browser what kind of file is come in 
    header("Content-Type: image/jpeg"); 

    //Output the newly created image in jpeg format 
    ImageJpeg($image); 
    
    //Free up resources
    ImageDestroy($image); 
} 
?>

/* Captcha error checking */

$field = "captcha";
$captcha=$_REQUEST["captcha"];	

$sec_code=$_SESSION["security_code"];

if ( ($_REQUEST["captcha"] == $_SESSION["security_code"]) && 
    (!empty($_REQUEST["captcha"]) && !empty($_SESSION["security_code"])) ) {

$this->referrer = "http://81.226.101.66/projektarbete/benni/TEST/register.php"; // The captcha code is right, go back to register.php

}

else{
if(!$subcaptcha || strlen($subcaptcha = trim($subcaptcha)) == 0){ // If the field is empty, display error
$form->setError($field, "* skriv in kod $sec_code");
$this->referrer = "http://81.226.101.66/projektarbete/benni/TEST/register.php";
}

else{
$form->setError($field, "* Fel kod $captcha , $sec_code "); // Else the captcha is wrong, display error
$this->referrer = "http://81.226.101.66/projektarbete/benni/TEST/register.php";
}
}

//Gets the browser specific XmlHttpRequest Object 
function getXmlHttpRequestObject() {
 if (window.XMLHttpRequest) {
    return new XMLHttpRequest(); //Mozilla, Safari ...
 } else if (window.ActiveXObject) {
    return new ActiveXObject("Microsoft.XMLHTTP"); //IE
 } else {
    //Display our error message
    alert("Your browser doesn't support the XmlHttpRequest object.");
 }
}

//Our XmlHttpRequest object
var receiveReq = getXmlHttpRequestObject();

//Initiate the AJAX request
function makeRequest(url, param) {
//If our readystate is either not started or finished, initiate a new request
 if (receiveReq.readyState == 4 || receiveReq.readyState == 0) {
   //Set up the connection to captcha_test.html. True sets the request to asyncronous(default) 
   receiveReq.open("POST", url, true);
   //Set the function that will be called when the XmlHttpRequest objects state changes
   receiveReq.onreadystatechange = updatePage; 

   receiveReq.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
   receiveReq.setRequestHeader("Content-length", param.length);
   receiveReq.setRequestHeader("Connection", "close");

   //Make the request
   receiveReq.send(param);
 }   
}

//Called every time our XmlHttpRequest objects state changes
function updatePage() {
 //Check if our response is ready
 if (receiveReq.readyState == 4) {
   //Get a reference to CAPTCHA image
   img = document.getElementById('imgCaptcha'); 
   //Change the image
   img.src = 'http://81.226.101.66/projektarbete/benni/TEST/captcha/create_...' + Math.random();
 }
}

//Called every time when form is perfomed
function getParam(theForm) {
 //Set the URL
 var url = 'include/session.php';
 //Set up the parameters of our AJAX call
 var postStr = theForm.txtCaptcha.name + "=" + encodeURIComponent( theForm.txtCaptcha.value );
 //Call the function that initiate the AJAX request
 makeRequest(url, postStr);
}