I don`t have much time atm to give more info, but i`ll try to post later with a more in depth opinion.
But, right off the bat i see 2 things:
1.) Although the oscommerce id disappears soon after you clikc through a few links (most likely being stored as a session var then after), you really should do away completely with the oscid being manipulate-able within the url. This poses a big possible security risk such as being able to access other`s account info.
2.) I was put off by your checkout buttons which are copies of amazon`s buttons.