None of those characters would get in the way of a $_POST; you'd want to use [man]htmlspecialchars[/man] so's you can stick it in the form field - while for putting it in the URL you could use [man]urlencode[/man]. base64_encode is another way of encoding the data, although it does bloat things a bit (as any such encoding would); convert_uuencode() could be used also, and you could gzcompress() to make it smaller before encoding it.
But why do you want to avoid using a session? For one thing, it would avoid risks of the object getting corrupted on the client.
