Search code examples
phpjsonserializationphpbb3

PHP unserializing returns false when array elements are expected

Some rows in a database table contains serialized data in a column:

select * from phpbb_config where config_name like 'convert%';
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------+------------+
| config_name       | config_value                                                                                                                                       | is_dynamic |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------+------------+
| convert_db_server | a:4:{s:4:\"dbms\";s:22:\"phpbb\\db\\driver\\mysqli\";s:6:\"dbhost\";s:9:\"127.0.0.1\";s:6:\"dbport\";s:0:\"\";s:6:\"dbname\";s:10:\"klein-putz\";} |          1 |
| convert_db_user   | a:2:{s:6:\"dbuser\";s:4:\"root\";s:8:\"dbpasswd\";s:0:\"\";}                                                                                       |          1 |
| convert_options   | a:2:{s:10:\"forum_path\";s:16:\"../../klein-putz\";s:7:\"refresh\";i:0;}                                                                           |          1 |
| convert_progress  | a:3:{s:4:\"step\";s:0:\"\";s:12:\"table_prefix\";s:6:\"phpbb_\";s:3:\"tag\";s:7:\"phpbb20\";}                                                      |          1 |
+-------------------+----------------------------------------------------------------------------------------------------------------------------------------------------+------------+

When unserialized though, all return false, rather than set a number of array elements, which suggests they are not properly serialized values.

The lines of code can be seen here:

https://github.com/phpbb/phpbb/blob/f8aa5fa34df41fcb5d493ea4e7e3931e7e9897ad/phpBB/install/convert/convertor.php#L96-L100

I have heard that when you serialize something, it is basically JSON. I ran these through a JSON validator and they all fail. It's just unclear why.

Solution

  • You have extra backslashes in your database string.

    Try this code:

    <?php
$data1 = 'a:3:{s:4:"step";s:0:"";s:12:"table_prefix";s:6:"phpbb_";s:3:"tag";s:7:"phpbb20";}';
$data2 = 'a:3:{s:4:\"step\";s:0:\"\";s:12:\"table_prefix\";s:6:\"phpbb_\";s:3:\"tag\";s:7:\"phpbb20\";}';

$test1 = unserialize($data1);
$test2 = unserialize($data2);

echo "<br>case1:";
var_dump($test1);

echo "<br>case2:";
var_dump($test2);
?>

    As you can see $data1 is de serialized correctly, but $data2 returns false.