Question

I’m passing urlencode()d serialize()d arrays around my webpages, via $_GET[].

Is it safe to deserialize() a value from $_GET? The deserialized array will sometimes be shown to the user. Would it be possible for a user to expose/reference variables or functions etc within my code? In other words, when deserializing the value, does PHP treat it as data or code?

Update:

I see the documentation says:
“Circular references inside the array/object you are serializing will also be stored. Any other reference will be lost. “

So that means i’m safe? 🙂

Answer 1

Absolutely, positively, no.

You shouldn’t blindly trust anything from the client side, however there is a way you can give yourself more confidence.

I’m assuming that if you’ve got PHP serialized data coming from the client side, that client obtained that from a server at some point? If that’s the case, and the client doesn’t modify the data, you could include a hash along with the data to verify it hasn’t been tampered with.

The other alternative would be to unserialize the object, but regard it as ‘tainted’, then copy and re-verify the unserialized data into a ‘clean’ object.