note 106411 deleted from function.unserialize by aharvey

Note Submitter: dcz at phpbb-seo dot com ---- If you are unserializing content from user input and you don't expect objects to be passed (which should be the most common case), you can use this to prevent any object reviving threat : <?php /** * mixed safe_unserialize(string $serialized) * Safely unserialize, that is only unserialize string, numbers and arrays, not objects * * @license Public Domain * @author dcz (at) phpbb-seo (dot) com */ function safe_unserialize($serialized) { // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if (is_string($serialized) && strpos($serialized, "\0") === false) { if (strpos($serialized, 'O:') === false) { // the easy case, nothing to worry about // let unserialize do the job return @unserialize($serialized); } else if (!preg_match('/(^|;|{|})O:[0-9]+:"/', $serialized)) { // in case we did have a string with O: in it, // but it was not a true serialized object return @unserialize($serialized); } } return false; } ?> Will simply return false if the serialized input contains an object or is not valid. Example of a successful use of the object reviving threat : http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/