PHP 教程
PHP 過濾 unserialize()
PHP 7 新特性PHP 7 增加了可以為 unserialize() 提供過濾的特性，可以防止非法數(shù)據(jù)進(jìn)行代碼注入，提供了更安全的反序列化數(shù)據(jù)。
實(shí)例
實(shí)例
<?php
class?MyClass1?{?
???public?$obj1prop;???
}
class?MyClass2?{
???public?$obj2prop;
}
$obj1?=?new?MyClass1();
$obj1->obj1prop?=?1;
$obj2?=?new?MyClass2();
$obj2->obj2prop?=?2;
$serializedObj1?=?serialize($obj1);
$serializedObj2?=?serialize($obj2);
//?默認(rèn)行為是接收所有類
//?第二個(gè)參數(shù)可以忽略
//?如果?allowed_classes?設(shè)置為?false,?unserialize?會將所有對象轉(zhuǎn)換為?__PHP_Incomplete_Class?對象
$data?=?unserialize($serializedObj1?,?["allowed_classes"?=>?true]);
//?轉(zhuǎn)換所有對象到?__PHP_Incomplete_Class?對象，只允許?MyClass1?和?MyClass2?轉(zhuǎn)換到?__PHP_Incomplete_Class
$data2?=?unserialize($serializedObj2?,?["allowed_classes"?=>?["MyClass1",?"MyClass2"]]);
print($data->obj1prop);
print(PHP_EOL);
print($data2->obj2prop);
?>
class?MyClass1?{?
???public?$obj1prop;???
}
class?MyClass2?{
???public?$obj2prop;
}
$obj1?=?new?MyClass1();
$obj1->obj1prop?=?1;
$obj2?=?new?MyClass2();
$obj2->obj2prop?=?2;
$serializedObj1?=?serialize($obj1);
$serializedObj2?=?serialize($obj2);
//?默認(rèn)行為是接收所有類
//?第二個(gè)參數(shù)可以忽略
//?如果?allowed_classes?設(shè)置為?false,?unserialize?會將所有對象轉(zhuǎn)換為?__PHP_Incomplete_Class?對象
$data?=?unserialize($serializedObj1?,?["allowed_classes"?=>?true]);
//?轉(zhuǎn)換所有對象到?__PHP_Incomplete_Class?對象，只允許?MyClass1?和?MyClass2?轉(zhuǎn)換到?__PHP_Incomplete_Class
$data2?=?unserialize($serializedObj2?,?["allowed_classes"?=>?["MyClass1",?"MyClass2"]]);
print($data->obj1prop);
print(PHP_EOL);
print($data2->obj2prop);
?>
以上程序執(zhí)行輸出結(jié)果為：
1 2
其他擴(kuò)展