note 101453 deleted from function.unserialize by danbrown

Note Submitter: Fanis Hatzidakis ---- With regards to TBag's is_serialized() function: Checking for preg_match() !== false doesn't mean it actually matched something. It means there were no errors. preg_match() will return int 1 if it matched something, int 0 if not. That is why the function returns true even though the regular expression doesn't actually match empty arrays or empty objects, whose serialized form doesn't have a ";". Empty arrays are "a:0:{}" and empty stdClasses are "O:8:"stdClass":0:{}". A crude way to fix the regular expression is to change it to "/^(i|s|a|o|d):(.*);?/si", with the ";?" indicating match or don't match a ";". Also consider that the regular expression doesn't match booleans, whose serialized form starts with a "b", although that's fine because the description does say "unserialize arrays and objects". Starting off with it as inspiration I created and am using the following function to strictly check if a given string is serialized, as an alternative to supressing errors and checking if unserialize() === false. <?php function is_serialized($val) { if (!is_string($val)) { return false; } if (trim($val) == "") { return false; } if (preg_match("/^((a|O):(.*))|((b|i|s|d|):(.*);)$/s", $val) === 1) { return true; } return false; } ?>