multi part/step web form

<?php
// called on eFormOnBeforeFormParse
function step1_populate(&$fields,&$templates){
	
	global $modx;
	
	# populate form with existing data
	$evt =&$modx->event; // The Snippet call event (not eFormOnBeforeFormParse event)
	$validFormId = ($evt->params['formid'] == $_POST['formid']);
	$isPostBack = ($validFormId && count($_POST) > 0); // (bool)true if the form is being updated

	if (!$isPostBack && isset($_SESSION['token']) && isset($_SESSION['row_id']) ) {
		
		$token = $modx->db->escape($_SESSION['token']);
		$row_id = $modx->db->escape($_SESSION['row_id']);
		
		// do query to get data from the db
		$sql="SELECT my_data_1 FROM my_table WHERE token= '{$token}' AND id='{$id}'";
	
		$result = $modx->db->query($sql);
		$row = $modx->db->getRow($result);
		# re-populate
		if (!empty($row)) {
			$fields = unserialize($row);
		}
		
		// add token to form to prevent CSRF
		$fields['token'] = $token;
	}
}

// called eFormOnBeforeMailSent - also set noemail=`1` in the eform snippet call
function step1_save(&$fields){
	
	global $modx;
	
	// only need to do this on step 1
	if (!isset($_SESSION['token'])) {
		// create a token, say from the user's firstname and lastname assuming they're on form 1
		$token .= strtoupper(substr($fields['firstname'],0,1)).strtoupper(substr($fields['lastname'],0,1));
		$token .= date('ymdHi');
		$token = md5($token);
		// store in session
		$_SESSION['token'] = $token;
	} else {
		if ($_SESSION['token'] !== $fields['token']) {
			exit;
		}
	}
	
	// insert data
	$token = $modx->db->escape($token);
	$data = $modx->db->escape(serialize($fields));

	$sql="INSERT INTO my_table SET my_data_1='{$data}', token='{$token}'";

	if ($result = $modx->db->query($sql)) {		
		$row_id = mysql_insert_id();
		//store insert id in the session for subsequent steps
		$_SESSION['row_id'] = $row_id;
		$modx->sendRedirect('/step-2/');
	}	
	return true;		
}

// step 2 poplutate is similar to step 1

// step 2 save - following step saves will be similar to this
function step2_save(&$fields){
	
	global $modx;
	
	if ( isset($_SESSION['token']) && isset($_SESSION['row_id']) ) {
		
		if ($_SESSION['token'] !== $fields['token']) {
			exit;
		}
		
		$token = $modx->db->escape($_SESSION['token']);
		$row_id = $modx->db->escape($_SESSION['row_id']);

		$data = $modx->db->escape(serialize($fields));
	
		$sql="UPDATE my_table SET my_data_2='{$data}' WHERE token='{$token}' AND id='{$id}'";
	
		if ($result = $modx->db->query($sql)) {		
			$row_id = mysql_insert_id();
			//store this in session for subsequent steps
			$_SESSION['row_id'] = $row_id;
			$modx->sendRedirect('/step-X/');
		}
	}
	session_write_close();
	
	return true;		
	
}

//steps 3,4 etc

function step6_save(&$fields){{
	
	global $modx;
	
	if (isset($_SESSION['token']) && isset($_SESSION['row_id']) ) {
		
		if ($_SESSION['token'] !== $fields['token']) {
			exit;
		}
		
		$token = $modx->db->escape($_SESSION['token']);
		$row_id = $modx->db->escape($_SESSION['row_id']);
		
		$sql="SELECT * FROM my_table WHERE token='{$token}' AND id='{$id}'";
	
		$result = $modx->db->query($sql);
	
		if ($result && mysql_num_rows($result)>0) {	
			$row = $modx->db->getRow($result);
			$fields = array_merge( $row['my_data_1'], $row['my_data_2'], $row['my_data_3'], $row['my_data_4'], $fields);
			
			 // now cleanup
			$sql2="DELETE * FROM my_table WHERE token='{$token}' AND id='{$id}'";
			$result2 = $modx->db->query($sql2);
		}
	}
	
	// now allow eform to send mail - make sure all form field placeholders are in the last report template
	return true;		
}