The form page that wait user input and the validation page is the same page!

I think that this is either a typo, or the crux of your misunderstanding. This script does not wait for the user. It runs once to show the form, and terminates, then again when the user completes the form.

There is no way to have a simple CGI script fetch user input without the user submitting an entirely new request. Your entire first run is long, long terminated by the time the user supplies credentials.