secure, non secure integration problem

I have some code to transfer a shopping cart session array (($SESSION["cart"]) from a non secure environment to a secure environment on a URL The code to build the URL is "?cart=".urlencode(serialize($SESSION["cart"])) The code to reinstate $SESSION["cart"] at the secure end is $SESSION["cart"] = unserialize( $cart ); This works OK in my development environment (win2k, Apache) but gives the following error on the production environment (Linux, Apache). Notice: unserialize() failed at offset 0 of 907 bytes in /homepages/25/d77553315/htdocs/prod/mightybanana.com/shop/secure/login.php on line 27 I have included the URL at the very end of this email. Has any one any idea as to why this is (is it something to do with the length of the URL). I include below the full details of moving between non-secure/secure but don't think they are necessary. Regards, Ben Passing session between secure and non-secure. Background There are two parts of the site. The non secure part (http://) and the secure part (https://). In PHP secure and non-secure environments do not share the same session. Session information is held in a variable called $SESSION. The shoping cart is held in an array of this variable, $SESSION[“cart”]. It is possible to add items to the cart before logging in. Implementation The first thing that is needed is for the URL used for logging in to include $SESSION[“cart”] as a variable (i.e. ?cart=…’). This is how I pass the session from the non-secure to the secure environment. This is done by a procedure called loginurl (misc.inc), which is called in header.html. $cart is a serialized version of $SESSION["cart"]. function loginurl() { global $SESSION; $append = ""; if( isset($SESSION["cart"]) ) { if( isset($SESSION["cart"]->items ) and sizeof( $SESSION["cart"]->items ) != 0 ) { $append = "?cart=".urlencode(serialize($SESSION["cart"])); } } $loginurl = $SESSION["homedir_secure"] . "/login.php$append"; return ($loginurl); } This URL is then used to call login.php (whitch is in the secure part of the site). At beginning of login.php if $cart set following is done $SESSION["cart"] = unserialize( $cart ); Therefore if $cart was passed is reinstated and unserialised to turn it back into an array . Later on in login.php (when user has successfully logged on) session_url(user.inc) is called. This douse two things:- Firstly it puts the $SESSION array in the database (it puts it in the users record). Secondly it returns a string to be appended to the URL so when we go back to the secure site we can retrieve the SESSION variable from the database. The URL contains ‘user=’, which has the username, and ‘hash=’ which is a md5 hash of a random word sequence. This sequence is also stored in the database in the user record as a security measure. function session_url($username) { global $SESSION, $REMOTE_ADDR; $db = open_db(); $objstr = serialize($SESSION); $otp = randompwd(); $md5 = md5( $otp . $REMOTE_ADDR ); $sql = "update user_info ". "set sess_tmp_otp ='$otp', ". " sess_tmp_obj ='" . prep($objstr) . "'"; " where username ='" . prep($username) . "'"; query_db($sql, $db); $url_append = "?hash=" . urlencode($md5) . "&username=" . urlencode($username); return($url_append); } The url is appended to all links from the secure (login) screen. At the beginning of user.inc (a file included at the beginning of all paged of the non secure site) Code is called which used ‘user=’ and ‘hash=’ to retrieve $SESSION from database. if(isset($hash)) // we were called by the secure login script { $sql = "select sess_tmp_otp, sess_tmp_obj from user_info "; include($SESSION["libdir"] . "/misc.inc"); $sql .="where username='" . prep($username) . "'"; $res = query_db($sql,$db); $row = fetch_array_db($res); // two md5s because a user going through transparent proxy // will have diff ip on port 443 than port 80 $md5 = md5($row[0] . $REMOTE_ADDR); $md5_try2=""; if(isset($HTTP_X_FORWARDED_FOR)) { $md5_try2 = md5($row[0] . $HTTP_X_FORWARDED_FOR); } if($md5 == $hash || $md5_try2 == $hash) { $SESSION=array(); $SESSION=unserialize($row[1]); } $sql = "update user_info set sess_tmp_otp='', sess_tmp_obj='' "; $sql .="where username='" . prep($username) . "'"; query_db($sql, $db); } http://www.mightybanana.com/shop/secure/login.php?cart=O%3A4%3A%22cart%22%3A18%3A%7Bs%3A9%3A%22web_order%22%3Bb%3A1%3Bs%3A12%3A%22product_code%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A5%3A%22MB115%22%3B%7Ds%3A10%3A%22media_type%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A2%3A%22OS%22%3B%7Ds%3A8%3A%22standard%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A3%3A%22O%26W%22%3B%7Ds%3A5%3A%22title%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A121%3A%22+POI-JOI+Spinning+Poi+-+Item+No.+MB+115%3Cspan+class%3DSmallText%3E%2C+Juggling+Stuff%2C+One+Size%2C+UV+Orange+%26+UV+White%2C+N%2FA%3C%2Fspan%3E%22%3B%7Ds%3A5%3A%22items%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bi%3A1%3B%7Ds%3A5%3A%22price%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A4%3A%229.99%22%3B%7Ds%3A6%3A%22weight%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A3%3A%22250%22%3B%7Ds%3A14%3A%22author_percent%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A1%3A%220%22%3 B%7Ds%3A13%3A%22material_cost%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A4%3A%220.00%22%3B%7Ds%3A10%3A%22price_type%22%3Ba%3A1%3A%7Bs%3A12%3A%22MB115%2FO%26W-OS%22%3Bs%3A4%3A%22NONE%22%3B%7Ds%3A4%3A%22type%22%3Bs%3A1%3A%22U%22%3Bs%3A6%3A%22tariff%22%3Bs%3A0%3A%22%22%3Bs%3A7%3A%22country%22%3Bs%3A4%3A%22NONE%22%3Bs%3A11%3A%22total_items%22%3Bi%3A1%3Bs%3A13%3A%22postage_total%22%3BN%3Bs%3A9%3A%22order_num%22%3Bi%3A0%3Bs%3A5%3A%22total%22%3Bi%3A-1000%3B%7D **************************************************************** * Ben Edwards Tel +44 (0)117 968 2602 ICQ 42000477 * * Critical Site Builder http://www.criticaldistribution.com * * online collaborative web authoring content management system * * Get alt news/views films online http://www.cultureshop.org * * i-Contact Progressive Video http://www.videonetwork.org * * Fun corporate graphics http://www.subvertise.org * * Bristol Indymedia http://bristol.indymedia.org * * Bristol's radical news http://www.bristle.org.uk * ****************************************************************