The empty shopping cart error can be caused by a few different things, but it is most often the result of incorrect path settings. StoreFront uses a non-persistent Session object to store customer information; this object cannot cross domains, and it is this property that causes the error. The following is a typical scenario:
StoreFront users often develop and test a site locally or at a staging site before publishing the site to a server; while the site is local, the site's Web Store Location setting will reflect this location; i.e., Http://localhost/thisweb/.
When the store is published to the Internet, the location will change and customers will be entering the site using the new URL. When a customer enters the site from http://www.myweb.com and then tries to add an item to their cart, they will be redirected to the domain name indicated by the Web Store Location entry. Because the URL shows a different domain name than that which the customer entered under, a change in domains will be perceived and the customer's shopping session will expire. The same thing will happen if the application path is set to a domain name and a customer enters under an IP, or vice versa. Also, if the Web Store Location is set to http://www.myweb.com, but a customer enters under http://myweb.com the same thing will happen: a change in domains will be perceived and the session will expire.
To troubleshoot this error, first verify the store's Web Store Location (this is set in the General tab of the Web Manager). Is it using the same domain name or IP you are accessing the site through? If not, change it to the correct domain name or IP, close and reopen the browser, and test again. If the error persists, consider replacing addproduct.asp and order.asp to rule out the possibility of corruption. Also contact your host and ask them to verify that the IUSR account or Everyone group has Change or Modify permission on the folder containing the web store's database and the database itself.