You need to be very careful while doing this sort of thing - any little errors are going to break it, and can be hard to track down. A few I've spotted are:
You have the 'scope' parameter out of sequence when building the data to sign. Data must be ordered alphabetically by key for the oauth signature to be correct.
You use "GET" as a parameter for calculateBaseString although you're using POST
You miss out the & delimiter when adding the oauth_signature
You call curl_setopt($ch, CURLOPT_POSTFIELDS twice, overwriting the OAuth signed data with a single parameter.
It's very possible there are other errors I've not spotted. Niall