note 101453 added to function.unserialize

With regards to TBag's is_serialized() function: Checking for preg_match() !== false doesn't mean it actually matched something. It means there were no errors. preg_match() will return int 1 if it matched something, int 0 if not. That is why the function returns true even though the regular expression doesn't actually match empty arrays or empty objects, whose serialized form doesn't have a ";". Empty arrays are "a:0:{}" and empty stdClasses are "O:8:"stdClass":0:{}". A crude way to fix the regular expression is to change it to "/^(i|s|a|o|d):(.*);?/si", with the ";?" indicating match or don't match a ";". Also consider that the regular expression doesn't match booleans, whose serialized form starts with a "b", although that's fine because the description does say "unserialize arrays and objects". Starting off with it as inspiration I created and am using the following function to strictly check if a given string is serialized, as an alternative to supressing errors and checking if unserialize() === false. <?php function is_serialized($val) { if (!is_string($val)) { return false; } if (trim($val) == "") { return false; } if (preg_match("/^((a|O):(.*))|((b|i|s|d|):(.*);)$/s", $val) === 1) { return true; } return false; } ?> ---- Server IP: 69.147.83.197 Probable Submitter: 212.31.98.210 ---- Manual Page -- http://www.php.net/manual/en/function.unserialize.php Edit -- https://master.php.net/note/edit/101453 Del: integrated -- https://master.php.net/note/delete/101453/integrated Del: useless -- https://master.php.net/note/delete/101453/useless Del: bad code -- https://master.php.net/note/delete/101453/bad+code Del: spam -- https://master.php.net/note/delete/101453/spam Del: non-english -- https://master.php.net/note/delete/101453/non-english Del: in docs -- https://master.php.net/note/delete/101453/in+docs Del: other reasons-- https://master.php.net/note/delete/101453 Reject -- https://master.php.net/note/reject/101453 Search -- https://master.php.net/manage/user-notes.php