Search code examples
phpobject-serialization

PHP serialize protected class variables with wrong character count?

I am dealing with a strange problem in PHP 5.2.6, serializing objects.

Apparently, PHP stores protected variables members with an asterix ahead of its name. That is normal and correct, however, look at the following example:

O:18:"object__songChords":1:{s:9:"*chords"}

*chords does not contain 9 characters, but 7 (with the asterix).

Naturally, i assumed that there is some misunderstanding on my side, and that PHP just counts the quotes, but when i compare this to other strings stored, i find that this is not the case.

Bottomline is that PHP fails to unserialize these objects, although the classes have not changed.

Notice: unserialize(): Error at offset 43 of 867 bytes in ...

Can anyone offer some insight on this?

EDIT (providing the class)

class object__songChords {
  protected $chords;
  protected $lyrics;
}

Please note that i stripped the above serialization example for the sake of simplicity – the actual serialization string of course contains both properties.

Solution

  • The count is not off, there are two \0 null characters separating the *, one on each side:

    $o = new object__songChords;
echo addslashes(serialize($o));

    Yields:

    O:18:\"object__songChords\":2:{s:9:\"\0*\0chords\";N;s:9:\"\0*\0lyrics\";N;}