<?php
session_start();
if(isset($_SESSION['user'])) {
header('Location:login.php');
}
?>
<?xml version="1.0" encoding="UTF-8"?> -- Why this line?
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11.dtd"> -- Use simple DOCTYPE for HTML5
<html xmlns="http:www.w3.org/1999/xhtml"xml:lang="en" lang="en"> -- namespace is not neccesary at all
<head>
<title> Welcome - <?php echo <$_SESSION['user']; ?></title>
</head>
<body>
<?php -- opening for inline PHP
<h2> Welcome!!!</h2> -- it should be echo as it is PHP code area here
<option value="realname"><?php echo $_SESSION['firstname']. ' ' .$_SESSION['lastname']?></option> -- it is still PHP code area, so no place for HTML. You also have here a nested inline PHP, that not supported anyway
?> -- closing for inline PHP
</body>
</html>
See the comments...
Except those cosmetic things around DOCTYPE all you have to do is remove the external PHP inline directive...