note 106411 added to function.unserialize

If you are unserializing content from user input and you don't expect objects to be passed (which should be the most common case), you can use this to prevent any object reviving threat : <?php /** * mixed safe_unserialize(string $serialized) * Safely unserialize, that is only unserialize string, numbers and arrays, not objects * * @license Public Domain * @author dcz (at) phpbb-seo (dot) com */ function safe_unserialize($serialized) { // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if (is_string($serialized) && strpos($serialized, "\0") === false) { if (strpos($serialized, 'O:') === false) { // the easy case, nothing to worry about // let unserialize do the job return @unserialize($serialized); } else if (!preg_match('/(^|;|{|})O:[0-9]+:"/', $serialized)) { // in case we did have a string with O: in it, // but it was not a true serialized object return @unserialize($serialized); } } return false; } ?> Will simply return false if the serialized input contains an object or is not valid. Example of a successful use of the object reviving threat : http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/ ---- Server IP: 69.147.83.197 Probable Submitter: 78.226.240.47 ---- Manual Page -- http://www.php.net/manual/en/function.unserialize.php Edit -- https://master.php.net/note/edit/106411 Del: integrated -- https://master.php.net/note/delete/106411/integrated Del: useless -- https://master.php.net/note/delete/106411/useless Del: bad code -- https://master.php.net/note/delete/106411/bad+code Del: spam -- https://master.php.net/note/delete/106411/spam Del: non-english -- https://master.php.net/note/delete/106411/non-english Del: in docs -- https://master.php.net/note/delete/106411/in+docs Del: other reasons-- https://master.php.net/note/delete/106411 Reject -- https://master.php.net/note/reject/106411 Search -- https://master.php.net/manage/user-notes.php