The problem of php obtaining the session value of verification code

Because your verification code picture has been output.

The output session is on the server side.

But the picture is loaded after the HTML code is sent to the browser.

They are out of sync.

Verification code cannot be sent directly to the client in the form of HTML, so it is meaningless to need verification code! The verification code is set to prevent illegal login (brute force cracking). If you put the verification code in HTML code, it is meaningless for brute force cracking.