PHP Sessions and HTML Validity

Another day, another person having problems with PHP sessions and amersands in URLs. You'll need to follow through to the HTML part (HTML email is bad enough, but non-multipart with a text alternative? Argh!), but don't follow his solution, its borked.

Where was I? Oh yes, I was prompted to write a detailed explanation of the problem and solutions so I can just pump off links to people in future. Corrections, extra information and general comments (especially nice ones) welcomed.