php反序列化毛病根本

微情歌微旋律

PHP序列化取序列化

做者：H3h3QAQ
1、PHP序列化战反序列化

1.PHP反序列化：

serialize()
将变量大概工具转换成字符串的历程，用于存储或通报PHP的值的历程种，同时没有丧失其规范战构造
常睹的序列化字母表示及其寄义：

1. a - array    ----->a:<n>:{<key 1><value 1>...<key n><value n>}
2. b - boolean  ----->b:<digit>
3. d - double   ----->d:<number>
4. i - integer  ----->i:<number>
5. o - common
6. r - reference
7. s - string   ----->s:<length>:"<value>"
8. C - custom object
9. O - class    ----->O:<length>:"<class name>":<n>:{<field name 1><field value1>...<field name n><field value n>}
10. N - null
11. R - pointer reference
12. U - unicode string

复造代码

1. <?php
2. class h3{
3.     public $v1;
4.     public $v2=false;
5.     public $v3=1;
6.     public $v4=2.1;
7.     public $v5=array();
8.     public $v6="h3h3QAQ";
9.     private $v7="H3h3QAQ";
10.     protected $v8="protected";
11. }
12. $s=serialize(new h3());
13. echo  $s;
14. var_dump(unserialize($s));

复造代码

天生phar文件

1. O:2:"h3":8:{s:2:"v1";N;s:2:"v2";b:0;s:2:"v3";i:1;s:2:"v4";d:2.1;s:2:"v5";a:0:{}s:2:"v6";s:7:"h3h3QAQ";s:6:" h3 v7";s:7:"H3h3QAQ";s:5:" * v8";s:9:"protected";}

复造代码

[code]<span class="token delimiter important">