Question

I have problem with Unserialize which return nothing after getting it from $_POST. I post a simple array from a form and I could see double quotes been added to the serialized string. I tried stripslashes before serialzing and before unserializing, but the result is the same with no output. I have turned of magic_quotes_gpc in php.ini and again no luck. When I hardcode the values in unserialize by adding “\” manually gave me the desired string, So I tried with addslashes and again left with nothing. Please help me resolve this.

<?php


$tmp = $_POST["strVid"];

$myNewArray = unserialize($trp);
print_r($myNewArray);

$myArray = array('key1'=>'value1', 'key2'=>'value2');
$serialized = serialize($myArray);
?>

<form  onsubmit="return validate(this)" action="test_serialize.php" method="post">
<input type="hidden" name="strVid1" value="this is mega shit"/>
<input type="hidden" name="strVid" value="<?php echo $serialized; ?>">
<input type="Submit" name="next" value="Next"/>

</form>

Updated…

After Serialize: a:2:{s:4:”key1″;s:6:”value1″;s:4:”key2″;s:6:”value2″;}

After stripslashes of Serialize: a:2:{s:4:”key1″;s:6:”value1″;s:4:”key2″;s:6:”value2″;}

when I add \ manually

$myNewArray = unserialize(“a:2:{s:4:\”key1\”;s:6:\”value1\”;s:4:\”key2\”;s:6:\”value2\”;} “);

I get the output as Array ( [key1] => value1 [key2] => value2 )

Thanks

Answer 1

In your code:

<input type="hidden" name="strVid" value="<?php echo $serialized; ?>">

That’s most certainly wrong, because the variable will contain double quotes; you must escape those:

<input type="hidden" name="strVid" value="<?php echo htmlspecialchars($serialized, ENT_QUOTES, 'UTF-8'); ?>">

Btw, this is assuming you’re doing this to unserialize it:

$myNewArray = unserialize($_POST["strVid"]);