note 125558 rejected from function.serialize by cmb
| From: | cmb@php.net | Date: | Tue, 01 Dec 2020 10:56:55 +0000 |
| Subject: | note 125558 rejected from function.serialize by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-215922@lists.php.net to get a copy of this message | ||
Note Submitter: goran_zarkovic at zoho dot com
----
There seems to be error in serialize() function #1 Example:
<?php
// $session_data contains a multi-dimensional array with session
// information for the current user. We use serialize() to store
// it in a database at the end of the request.
$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn,
"UPDATE sessions SET data = ? WHERE id = ?");
$sqldata = array (serialize($session_data), $_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata)) {
$stmt = odbc_prepare($conn,
"INSERT INTO sessions (id, data) VALUES(?, ?)");
if (!odbc_execute($stmt, $sqldata)) {
/* Something went wrong.. */
}
}
?>
SQL INSERT will result in data and id columns content inverted: $sqldata array contains session_data
and id, so positional data binding will have effect of column id containing session_data, and column
data containing PHP_AUTH_USER.
Proposed correction:
<?php
// $session_data contains a multi-dimensional array with session
// information for the current user. We use serialize() to store
// it in a database at the end of the request.
$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn,
"UPDATE sessions SET data = ? WHERE id = ?");
$sqldata = array (serialize($session_data), $_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata)) {
$stmt = odbc_prepare($conn,
"INSERT INTO sessions (id, data) VALUES(?, ?)");
$sqldata = array ($_SERVER['PHP_AUTH_USER'], serialize($session_data) );
if (!odbc_execute($stmt, $sqldata)) {
/* Something went wrong.. */
}
}
?>