You really should indent your code to make it readable, otherwise it's way too hard to see where an if block starts and ends. Also, do use php tags instead of code tags to get syntax highlighting.
At one point you assign $SESSION to $POST. While you can do so and still create code that works, I recommend against putting data into $_POST that doesn't come from a post request.
array + array makes no sense. You should possibly use array_merge, but I advice you to explicitly assign the things that should go into session. First off, only nun-numeric string keys are overwritten, while integer or numeric strings are appended (and thus keys being changed). Also, a user can create any post data they want, and you should not blindly add things to session.
Moreover, you definitely need to sanitize user input. Here's a simple example on how to both only include post data that you allow, while also checking that the supplied data matches certain criteria, such as what characters and what string lengths are allowed. The code could of course be extended to give more meaningful error messages etc.
session_start();
# This defines what post fields are allowed, and also what regexp patterns to use for validation
# You could of course turn the array values into arrays themselves, containing things like
# 'pattern' => REGEXP_PATTERN, 'error_message' => MEANINGFUL_ERRORMESSAGE,
# 'type' => string|int|float (to allow for typecasting since post data is always string)
# This example allows 4-6 characters, a-z only for promoter
# upper and lowercase letters, digits and underscore, 3-20 characters for name
# amount has to be digits only, and at least one digits long.
$post_fields = array('promoter' => '#^[a-z]{4,6}$#', 'name' => '#^[a-zA-Z0-9_]{3,20}#', 'amount' => '#^\d+$#');
# example post data - these should all be ok
$_POST = array('promoter' => 'alpha', 'name' => 'bravo', 'amount' => '10');
$post_errors = array();
foreach ($post_fields as $field => $pattern)
{
if (isset($_POST[$field]))
{
if (preg_match($pattern, $_POST[$field], $m))
$_SESSION[$field] = $m[0];
else
{
$post_errors[] = 'Invalid input for ' . $field;
}
}
}
printf('<pre>%s</pre>', print_r($_SESSION,1));
foreach ($post_errors as $v)
printf('<div style="color: red;">%s</div>', $v);
# clear out $_SESSION for another example
$_SESSION = array();
# example post data - none of these will pass
# first string is too long. second string contains invalid characters
# the last contains non-digit characters
$_POST = array('promoter' => 'string_too_long', 'name' => '!"#€fds', 'amount' => 'ten', 'unknown_field' => 'will not be included');
$post_errors = array();
foreach ($post_fields as $field => $pattern)
{
if (isset($_POST[$field]))
{
if (preg_match($pattern, $_POST[$field], $m))
$_SESSION[$field] = $m[0];
else
{
$post_errors[] = 'Invalid input for ' . $field;
}
}
}
printf('<pre>%s</pre>', print_r($_SESSION,1));
foreach ($post_errors as $v)
printf('<div style="color: red;">%s</div>', $v);
