Try not doing the urldecode. I believe that once the data comes across the $_GET, it is automatically decoded. For example, if you pass "hello%20world" as a get parameter and then echo it on the page, it will echo as "hello world" and not "hello%20world". Your urldecode may be destroying some stuff by decoding things that shouldn't be decoded. I could see a definate issue if for instance you have the "%" char anywhere in your serialized array. Also, you probably don't want to be passing entire arrays of stuff via GET unless you have no other alternative. I would stick to session variables for that sort of thing...