Comments on: A reliable way to serialize/unserialize objects in PHP http://efiquest.org/2007-12-10/6/ (mostly in programming and *nix administration) Sun, 06 Jul 2008 19:44:27 +0000 http://wordpress.org/?v=2.2.3 By: kate http://efiquest.org/2007-12-10/6/#comment-219 kate Thu, 06 Mar 2008 11:40:41 +0000 http://efiquest.org/2007-12-10/6/#comment-219 good post man thx good post man thx

]]> By: Веб-обзор #10 - бизнес, бизнес, немного РНР, совсем немного PostgreSQL и архитектуры Flickr и Google на русском. | Alpha-Beta-Release Blog http://efiquest.org/2007-12-10/6/#comment-207 Веб-обзор #10 - бизнес, бизнес, немного РНР, совсем немного PostgreSQL и архитектуры Flickr и Google на русском. | Alpha-Beta-Release Blog Sun, 10 Feb 2008 10:49:34 +0000 http://efiquest.org/2007-12-10/6/#comment-207 [...] A reliable way to serialize/unserialize objects in PHP - ещё один материал, более основательный, для РНР разработчиков, который расскажет о таком, казалось бы тривиальном процессе, как сериализация и десериализация объектов. На самом деле это совсем не так просто и чревато разными подводными камнями, особенно для начинающих программистов, так что очень рекомендуется для изучения. [...] […] A reliable way to serialize/unserialize objects in PHP - ещё один материал, более основательный, для РНР разработчиков, который расскажет о таком, казалось бы тривиальном процессе, как сериализация и десериализация объектов. На самом деле это совсем не так просто и чревато разными подводными камнями, особенно для начинающих программистов, так что очень рекомендуется для изучения. […]

]]> By: Adam http://efiquest.org/2007-12-10/6/#comment-123 Adam Wed, 09 Jan 2008 13:55:40 +0000 http://efiquest.org/2007-12-10/6/#comment-123 Serialize for the win! Serialize for the win!

]]> By: developercast.com » Pavel Shevaev’s Blog: A reliable way to serialize/unserialize objects in PHP http://efiquest.org/2007-12-10/6/#comment-54 developercast.com » Pavel Shevaev’s Blog: A reliable way to serialize/unserialize objects in PHP Tue, 11 Dec 2007 18:45:04 +0000 http://efiquest.org/2007-12-10/6/#comment-54 [...] Shevaev has posted his method (a reliable way) for serializing and unserializing objects in your [...] […] Shevaev has posted his method (a reliable way) for serializing and unserializing objects in your […]

]]> By: PHPDeveloper.org http://efiquest.org/2007-12-10/6/#comment-53 PHPDeveloper.org Tue, 11 Dec 2007 13:57:29 +0000 http://efiquest.org/2007-12-10/6/#comment-53 <strong>Pavel Shevaev's Blog: A reliable way to serialize/unserialize objects in PHP...</strong> Pavel Shevaev has posted his method (a reliable way) for serializing ...... Pavel Shevaev’s Blog: A reliable way to serialize/unserialize objects in PHP…

Pavel Shevaev has posted his method (a reliable way) for serializing ……

]]> By: Alexey Zakhlestin http://efiquest.org/2007-12-10/6/#comment-51 Alexey Zakhlestin Mon, 10 Dec 2007 11:14:17 +0000 http://efiquest.org/2007-12-10/6/#comment-51 At some point I thought you would go the "java way" and put the code of the class into serialized stream ;) Solution is an interesting one. Though, I doubt I will have a use-case for that. My projects usually have "ezc-style" autoload maps (and I patch external libs which I use to do the same) At some point I thought you would go the “java way” and put the code of the class into serialized stream ;)

Solution is an interesting one. Though, I doubt I will have a use-case for that. My projects usually have “ezc-style” autoload maps (and I patch external libs which I use to do the same)

]]> By: pachanga http://efiquest.org/2007-12-10/6/#comment-50 pachanga Mon, 10 Dec 2007 10:35:16 +0000 http://efiquest.org/2007-12-10/6/#comment-50 >Although I’m not in favour of this approach. >I think that a well structured application layout is very important... >If you have that then you know where class structures are located >and can find them easily at runtime by use of __autoload Unfortunately, this is often not the case when dealing with misc. external libraries which have different file system layout, naming conventions or simply don't use __autoload at all. >Although I’m not in favour of this approach.
>I think that a well structured application layout is very important…
>If you have that then you know where class structures are located
>and can find them easily at runtime by use of __autoload

Unfortunately, this is often not the case when dealing with misc. external libraries which have different file system layout, naming conventions or simply don’t use __autoload at all.

]]> By: pachanga http://efiquest.org/2007-12-10/6/#comment-49 pachanga Mon, 10 Dec 2007 10:31:21 +0000 http://efiquest.org/2007-12-10/6/#comment-49 sorccu, I believe this should be a concern of the code using SerializableContainer. SerializableContainer is a pretty generic solution and it simply can't predict all possible misuses. The same security concerns are valid for serialize/unserialize calls too. Anyway thanks for raising this issue. sorccu, I believe this should be a concern of the code using SerializableContainer. SerializableContainer is a pretty generic solution and it simply can’t predict all possible misuses. The same security concerns are valid for serialize/unserialize calls too. Anyway thanks for raising this issue.

]]> By: sorccu http://efiquest.org/2007-12-10/6/#comment-48 sorccu Mon, 10 Dec 2007 10:05:21 +0000 http://efiquest.org/2007-12-10/6/#comment-48 var_dump(preg_match('~([||;]O|^O):\d+:"([^"]+)":\d+:{~', serialize('user;O:3:"Foo":0:{}input'))); So, depending on what you are serializing, some evil madman could be able to force you to load a class file that isn't necessarily needed. Given the need for the class to already exist at the time of serializing, this is hardly a serious risk but it is nevertheless quite scary. var_dump(preg_match(’~([||;]O|^O):\d+:”([^”]+)”:\d+:{~’, serialize(’user;O:3:”Foo”:0:{}input’)));

So, depending on what you are serializing, some evil madman could be able to force you to load a class file that isn’t necessarily needed. Given the need for the class to already exist at the time of serializing, this is hardly a serious risk but it is nevertheless quite scary.

]]> By: pachanga http://efiquest.org/2007-12-10/6/#comment-47 pachanga Mon, 10 Dec 2007 08:07:57 +0000 http://efiquest.org/2007-12-10/6/#comment-47 James, you are right about possible problems due to files relocation, I'll update the drawbacks list, thanks. Fortunately, this happens not that often to be a real issue(at least in my practice). However if this approach is used in a cluster, all servers _must_ have all PHP code stored using identical file system layout for obvious reasons. James, you are right about possible problems due to files relocation, I’ll update the drawbacks list, thanks. Fortunately, this happens not that often to be a real issue(at least in my practice). However if this approach is used in a cluster, all servers _must_ have all PHP code stored using identical file system layout for obvious reasons.

]]>