Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:47063
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.220.223 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=mime-version:reply-to:in-reply-to:references:from:date:message-id
         :subject:to:cc:content-type:content-transfer-encoding;
        b=xqVRZovzSrWhqkB03jF42Fb1hMrAGaYjGlFolmZCdKySFUSSlQldkpUkLqetVJSBdY
         QUb2cgZgOYgkxnJcymqHO2W4wOr1yFkpfXoPsKFmD20ktmGVladd0pwXexa/K+o7sF+t
         m2Lwwkxm/V+ccL0s8xOjbBUlAQPJhSLeacuyQ=
MIME-Version: 1.0
Reply-To: RQuadling@googlemail.com
In-Reply-To: <f658eb6f1002281103k28973951xe3ba6512ee8350fe@mail.gmail.com>
References: <4B8A97AF.3060608@seld.be> <f658eb6f1002281103k28973951xe3ba6512ee8350fe@mail.gmail.com>
Date: Sun, 28 Feb 2010 19:35:15 +0000
Message-ID: <10845a341002281135w686664eej484e0686010bd1d6@mail.gmail.com>
To: Herman Radtke <hermanradtke@gmail.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Unserialize is broken
From: rquadling@googlemail.com (Richard Quadling)

On 28 February 2010 19:03, Herman Radtke <hermanradtke@gmail.com> wrote:
>> Imo unserialize should check, when applying public or protected values,
>> if either exists on the object, and apply it to the one that exists.
>> Sure it's gonna cost some performance, but at least changing the
>> prototype of your class while stuff is running isn't going to kill your
>> code anymore.
>
> This seems like a corner case and one that a conversion script should
> handle. =C2=A0Considering that serialize and unserialize are called for
> every single web-request, degrading the performance of unserialize is
> not something that should be done lightly.
>
>
>
> --
> Herman Radtke
> hermanradtke@gmail.com | http://hermanradtke.com
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

As serializing reports protected and private properties, would it not
be right that unserialize should work within the private scope of an
object and then follow the same rules as userland code.

It would guess that unserialize really doesn't need to know the
visibility or at least shouldn't be creating properties based upon
those visibilities but rather applying the values to the existing
properties.




--=20
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
EE4Free : http://www.experts-exchange.com/becomeAnExpert.jsp
Zend Certified Engineer : http://zend.com/zce.php?c=3DZEND002498&r=3D213474=
731
ZOPA : http://uk.zopa.com/member/RQuadling