Member Avatar for Dani

Currently, to check if something is serialized, I do this:

function is_serialized($data)
{
    return (@unserialize($data) !== false);
}

But it issues an E_NOTICE. The @ is great to suppress output, but it's still clogging up every other line of my error log (which is purposefully enabled for notices). Are there any cleaner alternatives??

  • 2 Contributors
  • 3 Replies
  • 4K Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by IIM

Dani AI

Generated

If you want to avoid the error-log noise without using the @ operator, wrap just the unserialize() call in a temporary error handler and add a quick preflight check so you only try to parse strings that look like PHP serialization. This keeps page-wide error_reporting intact (unlike Post #4) and avoids the fragile regex approach in Post #3 (note that the /e modifier used there was deprecated and is removed in PHP 7+; see preg_replace).

function looks_serialized(string $s): bool {
    $s = trim($s);
    if ($s === 'N;') return true;
    if (!preg_match('/^(?:[abisdO]):/', $s)) return false;
    $last = substr($s, -1);
    if ($s[0] === 's') return $last === '"' || $last === ';'; // string ends with '";'
    if ($s[0] === 'a' || $s[0] === 'O') return $last === '}';
    return $last === ';';
}

function is_serialized_str($s): bool {
    if (!is_string($s) || !looks_serialized($s)) return false;
    $prev = set_error_handler(function () { /* swallow unserialize notices/warnings */ }, E_NOTICE | E_WARNING);
    $value = unserialize($s, ['allowed_classes' => false]); // block object instantiation
    restore_error_handler();
    return !($value === false && $s !== 'b:0;'); // account for serialized false
}

Security note: never pass untrusted input to unserialize() unless you fully control it and have blocked object instantiation via allowed_classes => false. If you are designing a format for interchange or storage, prefer JSON with [json_encode](https://www.php.net/manual/en/function.json-encode.php) and [json_decode](https://www.php.net/manual/en/function.json-decode.php). For localized handling of notices, use a scoped handler as above rather than changing global reporting; see [set_error_handler](https://www.php.net/manual/en/function.set-error-handler.php) and avoid site-wide side effects. For data you do control, consider replacing serialization entirely with [serialize](https://www.php.net/manual/en/function.serialize.php) only when you specifically need PHP types.

Recommended Answers

All 3 Replies

Member Avatar for IIM

Warning
FALSE is returned both in the case of an error and if unserializing the serialized FALSE value. It is possible to catch this special case by comparing str with serialize(false) or by catching the issued E_NOTICE.

Warning
Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.

Quote from manual

Will work on it and let you know to supresss E_NOTICE other than using @

Member Avatar for IIM

As per what i have digged out ,you are doing it in proper way except for use base64_decode($data) instead of $data.

Another way to do the same is to use regular expression instead of calling unserialize() method as the data retured after serialization returns particular format.
For String like :
s:4:"test"
For Array like
a:4:"test"

 function mb_unserialize($serial_str) {  
$out = preg_replace('!s:(\d+):"(.*?)";!se', "'s:'.strlen('$2').':\"$2\";'", $serial_str );  
return unserialize($out);  
}

Check http://stackoverflow.com/questions/4748795/how-to-find-out-if-a-string-is-a-serialized-object-array-or-just-a-string

Edited by IIM
Member Avatar for IIM 
$error_reporting = error_reporting(error_reporting() ^ E_NOTICE);

$y = unserialize("sdfsdf");
if($y) {
   echo $y;
}
else {
    // do something else
}

error_reporting($error_reporting);

By this you can change error_reporting .It says that report error for all except E_NOTICE.

I am not sure whether this can be configured for a page only.
Please do let me know if error_reporting can be changed from page to page if required.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.