Re: unserialize() data from untrusted source

Jason Garber wrote:

This is an interesting point you bring up. When we have large registration processes or similar multi-page forms, we write our data array to a hidden field using.

    base64_encode(serialize($aData))

and read it in with

    unserialize(base64_decode($_POST['aData']))

passing it from page to page with POST.

I fail to understand, in your scenario, why you don't simply save the data in a session? You're effectively generated some data server and send it to the client only to get it back on the next request; typical session scenario, if you ask me. cheers, - Markus