Thanks for pointing out the CF, that changes things a bit. Do you have your application.cfm page in the root of your site with the session management enabled? This is the key to making use of sessions in CF. If the sessions are not working correctly you will have issues like this.
The order id should be set to either the session id or the id of from the orders table where the order was inserted. Post back with your confirm page minus any sensitive details so we can look into the order id variable further.
