Replace your call to urldecode w/ stripslashes(). PHP is automatically escaping the quotes on incoming data which makes it no longer unserializable.
Use:
$ary=unserialize(stripslashes($ary));
Instead of:
$ary=unserialize(urldecode($ary));
That will do it.
Jack