create an object, serialize it, and stuff it in a session variable. each page should unserialize the object so it can add/modify/retrieve/delete values and then re-serialize it and update the session variable. at the end of the process you have a nice object with all the info from all three forms.
If you elect to pass the info in the URL, you're allowing the user to give you bogus data which you have to put a lot more code to validate or run the risk of unpredictable behavior.
You can also post it, serialize the $_POST array and stuff it in a hidden field in the form on each successive page. That can be ugly though because you are slowing the page down with a bunch of extra text (even though it's hidden to the user, they still have to download the extra bytes) not to mention it makes your forms spoofable.
I'd go with session vars. It gives the user the least access to tamper with the data.