this function _really_ split and decode session data:
function unserializesession($data) {
$vars=preg_split('/([a-zA-Z0-9]+)\|/',$data,-1,PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
for($i=0; $vars[$i]; $i++) {
$result[$vars[$i++]]=unserialize($vars[$i]);
}
return $result;
}
the difference from previously posted 'unserializesession' function is the regular expression inside function preg_split ('[a-zA-Z0-9]+' vs '[a-z,A-Z]+' )