Have Geek Brain

Serializing array in PHP, preventing injection

I am writing a PHP script that uses serialized arrays to store data. How can I prevent serialization injection? Your account name would be very easy:

something";s:6:"access";s:5:"admin";

for a simple example. The user could then add the rest of the required parameters. Will work on this? Does php unserialize take this as a runaway character? If so, is it possible to apply additional characters to the whole array without repeating through?

Thanks for the help!

+2


a source to share


1 answer


The best way to find out is to try serializing an array with a string that has

Anyway: yes, serialize does respect double quotes in the data you store:



$ php -r "var_dump(unserialize(serialize(array('\"'))));"
array(1) {
  [0]=>
  string(1) """
}
+3


a source






More articles:


All Articles