Search code examples
phpphpexcelserializable

PHP serializable working on localhost but not on webserver


I'm working on a web page where I have some data visualized in html tables. I want the user to be able to retriev the data as an Excel document and am using PHPExcel for this purpose. The data is stored in a array of arrays, array(array first row(first col, ..., last col), ..., array last row(first col, ..., last col)). So in order to pass the data to datatoexcel.php, where the excel file is made, I serialize the array and sends it with POST.

$functiondata = serialize($func[1]);
echo '<form action="datatoexcel.php" name="dataform" method="post">'.
 '<input type=hidden name="functiondata"  value="'.htmlspecialchars($functiondata).'">'.
 '<input type="radio" name="format" value="xls" checked>xls'.
 '<input type="radio" name="format" value="xlsx">xlsx'.
 '</form>';
echo "<a href=\"#\" onclick=\"document['dataform'].submit()\">Export table data</a>";

The data is then retrieved at datatoexcel.php with:

$serialized_func = $_POST['functiondata'];
$funcdata = unserialize($serialized_func);

This works excellently while on localhost, but when I run it on the webserver $funcdata doesn't seem to have any data. Localhost runs Windows 7 with Apache2 and PHP 5.2.17 and the webserver runs Linux RedHat 5.2 with Apache2 and PHP 5.2.6. PHPExcel is working on the webserver, I tried creating a hardcoded array in datatoexcel.php and the excel document turned out fine.


Solution

  • Are you testing it with exact same input data? Also does your local or remote server have magic_quotes enabled? This may interfere with your input data also.

    I think it may have something to do with using htmlspecialchars(). If htmlspecialchars() converts any of the chars from input, then you must use htmlspecialchars_decode($serialized_func) before unserializing it:

    unserialize(htmlspecialchars_decode($serialized_func));

    Lastly, make sure to set error_reporting(E_ALL);

    at the start of your script, you may be able to catch some warnings that way.