Check your data that comes in $_REQUEST['settings'] it will most likely
have to be URL decoded to work properly with the unserializer. This
might work better:
$settings = rawurldecode($_REQUEST['settings']);
Debug outputting with <p> is a bad idea since url encoded characters
will be interpreted by the browser.