No way I'm going to read a couple thousand lines of source code, without any clue as to where the problem is. However, just looking at the top of the file, you do not appear to do anything if $_SESSION['user'] is not set, which means you're going to have an undefined variable a few lines later where you reference $user if it's not set.
But really, this is a good example of why modularization of code either via functions or objects could make things a lot easier to debug, rather than just one "stream of consciousness" script. At this point, without a major rewrite, all I can suggest is sticking in [man]var_dump/man's and/or [man]debug_print_backtrace/man's to find out what values various things have, what your query strings really look like, etc.