note 110552 deleted from function.unserialize by aharvey
| From: | aharvey@php.net | Date: | Tue, 06 Nov 2012 01:39:38 +0000 |
| Subject: | note 110552 deleted from function.unserialize by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-191731@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
DO NOT USER the safe_unserialize() function by dzb@php-seo.com below.
This attempt to protect unserialize() against malicious user input is just completely broken. There
are many different tricks allowing to modify a serialized string in a way that it will cleanly pass
the preg_match() checks and still exploits the application.
NEVER EVER UNSERIALIZE() USER INPUT.