note 123681 added to function.unserialize
| From: | Anonymous@php.net | Date: | Mon, 11 Mar 2019 18:36:04 +0000 |
| Subject: | note 123681 added to function.unserialize | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-210356@lists.php.net to get a copy of this message | ||
If serialize() is the answer, you're almost certainly asking the wrong question.
JSON is widely available. The only thing it does not do, is the very thing that makes serialization
immensely dangerous. All it takes is a crafty hacker to pass a crafted payload to a supposedly
'secured' serialize call, for a database driver to be overwritten with malicious code, for
example.
Recreate the object. Normally. With actual data, and a source file, not with serialize. To do
otherwise is laziness bordering on malice.
----
Server IP: 208.43.231.9
Probable Submitter: 82.199.157.34 (proxied: 2601:782:400:952:ad8d:494:5515:99a9)
----
Manual Page -- http://php.net/manual/en/function.unserialize.php
Edit -- https://master.php.net/note/edit/123681
Del: integrated -- https://master.php.net/note/delete/123681/integrated
Del: useless -- https://master.php.net/note/delete/123681/useless
Del: bad code -- https://master.php.net/note/delete/123681/bad+code
Del: spam -- https://master.php.net/note/delete/123681/spam
Del: non-english -- https://master.php.net/note/delete/123681/non-english
Del: in docs -- https://master.php.net/note/delete/123681/in+docs
Del: other reasons-- https://master.php.net/note/delete/123681
Reject -- https://master.php.net/note/reject/123681
Search -- https://master.php.net/manage/user-notes.php