Serializing array in PHP, preventing injection

Posted by Cyclone on Stack Overflow See other posts from Stack Overflow or by Cyclone
Published on 2010-05-05T00:01:16Z Indexed on 2010/05/05 0:08 UTC
Read the original article Hit count: 297

Filed under:

php

|

serialization

|

sanitization

I'm writing a PHP script which uses serialized arrays to store data. How can I prevent injection in serialization? It would be very easy to name your account:

something";s:6:"access";s:5:"admin";

for a simple example. The user could then add the rest of the needed parameters somehow. Would addslashes work for this? Does the php unserialize pick up on that as being an escaped character? If so, is it possible to apply addslashes to an entire array without iterating through?

Thanks for the help!

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about serialization

XML Serialization and Soap Serialization

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi I think even if we will not need interoperability between applications, and even we do not communicate with web services, it is easier to serialize using SoapFormatter than XmlSerializer because SOAP will serialize the private members by default, while XmlSerializer will work on public properties… >>> More
Binary serialization/de-serialization in C++ and C#

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello. I am working on a distributed application which has two components. One is written in standard C++ (not managed C++) and the other one is written in C#. Both are communicating via a message bus. I have a situation in which I need to pass objects from C++ to C# application and for this I need… >>> More
Insert some data at later point once serialization(binary serialization) is done for a class

as seen on Stack Overflow - Search for 'Stack Overflow'
My application is written in C# and I am a newbie to C#. I am facing with a problem during serialization. The problem is as follows. There are many classes in my project and when serialization is called on one of the main class object it serializes itself and during this process many of the member… >>> More
FormatException with IsolatedStorageSettings

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a problem when serializing a Dictionary<string,Person> to IsolatedStorageSettings. I'm doing the following: public Dictionary<string, Person> Names = new Dictionary<string, Person>(); if (!IsolatedStorageSettings.ApplicationSettings.Contains("Names")) { … >>> More
Serialization of Queue type- Serialization not working; C#

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi All, Consider this piece of code: private Queue Date=new Queue(); //other declarations public DateTime _Date { get { return (DateTime)Date.Peek();} set { Date.Enqueue(value); } } //other properties and stuff.... public void UpdatePosition(...) { //other code … >>> More