note 125558 added to function.serialize
| From: | goran_zarkovic.zoho.com via php-notes | Date: | Tue, 01 Dec 2020 10:29:07 +0000 |
| Subject: | note 125558 added to function.serialize | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-215921@lists.php.net to get a copy of this message | ||
There seems to be error in serialize() function #1 Example:
<?php
// $session_data contains a multi-dimensional array with session
// information for the current user. We use serialize() to store
// it in a database at the end of the request.
$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn,
"UPDATE sessions SET data = ? WHERE id = ?");
$sqldata = array (serialize($session_data), $_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata)) {
$stmt = odbc_prepare($conn,
"INSERT INTO sessions (id, data) VALUES(?, ?)");
if (!odbc_execute($stmt, $sqldata)) {
/* Something went wrong.. */
}
}
?>
SQL INSERT will result in data and id columns content inverted: $sqldata array contains session_data
and id, so positional data binding will have effect of column id containing session_data, and column
data containing PHP_AUTH_USER.
Proposed correction:
<?php
// $session_data contains a multi-dimensional array with session
// information for the current user. We use serialize() to store
// it in a database at the end of the request.
$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn,
"UPDATE sessions SET data = ? WHERE id = ?");
$sqldata = array (serialize($session_data), $_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata)) {
$stmt = odbc_prepare($conn,
"INSERT INTO sessions (id, data) VALUES(?, ?)");
$sqldata = array ($_SERVER['PHP_AUTH_USER'], serialize($session_data) );
if (!odbc_execute($stmt, $sqldata)) {
/* Something went wrong.. */
}
}
?>
----
Server IP: 45.112.84.4
Probable Submitter: 45.91.156.130 (proxied: 141.138.45.174)
----
Manual Page -- http://php.net/manual/en/function.serialize.php
Edit -- https://master.php.net/note/edit/125558
Del: integrated -- https://master.php.net/note/delete/125558/integrated
Del: useless -- https://master.php.net/note/delete/125558/useless
Del: bad code -- https://master.php.net/note/delete/125558/bad+code
Del: spam -- https://master.php.net/note/delete/125558/spam
Del: non-english -- https://master.php.net/note/delete/125558/non-english
Del: in docs -- https://master.php.net/note/delete/125558/in+docs
Del: other reasons-- https://master.php.net/note/delete/125558
Reject -- https://master.php.net/note/reject/125558
Search -- https://master.php.net/manage/user-notes.php