Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:47066
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=references:message-id:from:to:in-reply-to:content-type
         :content-transfer-encoding:x-mailer:mime-version:subject:date:cc;
        b=AngSVC8uSW60aWlsGSZUTpMgpLFomEVcf+h9MAF75Zq3DtbMltBxXBseb+Vjeth59Z
         G4JmDXxhNNpNsFTx4w3OUQ78VYjAg/mezRCwkbCHDq88sPajJjwvTrFPDB0FxDJT4E9V
         OpT5RHId638q7ZbvWdbqAgiGjSjPTb8sNYktU=
References: <4B8A97AF.3060608@seld.be> <f658eb6f1002281103k28973951xe3ba6512ee8350fe@mail.gmail.com> <4bcbf4711002281200u409f041dm330a328eb546e039@mail.gmail.com>
Message-ID: <1199A1E8-7663-4A1F-ACEB-1D2B77569BAE@gmail.com>
To: Jordi Boggiano <j.boggiano@seld.be>
In-Reply-To: <4bcbf4711002281200u409f041dm330a328eb546e039@mail.gmail.com>
Content-Type: text/plain;
	charset=us-ascii;
	format=flowed;
	delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (iPod Mail 7D11)
Date: Mon, 1 Mar 2010 17:31:54 +0800
Cc: Herman Radtke <hermanradtke@gmail.com>,
 "internals@lists.php.net" <internals@lists.php.net>
Subject: Re: [PHP-DEV] Unserialize is broken
From: tjerk.meesters@gmail.com (Tjerk Meesters)

Hi,

If visibility is an issue why not just use json_enode/decode for this  
case then?it doesn't seem like a typical enough problem to be solved  
low-level and json seems fast enough for the job ;-)


On 01-Mar-2010, at 4:00, Jordi Boggiano <j.boggiano@seld.be> wrote:

> On Sun, Feb 28, 2010 at 8:03 PM, Herman Radtke  
> <hermanradtke@gmail.com> wrote:
>>> Imo unserialize should check, when applying public or protected  
>>> values,
>>> if either exists on the object, and apply it to the one that exists.
>>> Sure it's gonna cost some performance, but at least changing the
>>> prototype of your class while stuff is running isn't going to kill  
>>> your
>>> code anymore.
>>
>> This seems like a corner case and one that a conversion script should
>> handle.  Considering that serialize and unserialize are called for
>> every single web-request, degrading the performance of unserialize is
>> not something that should be done lightly.
>
> Well.. the problem is you can't use __wakeup() for it, because at that
> point it's too late to read the values, it could work if you got the
> properties as an array or something as __wakeup($data), but that's not
> the case. So the only approach would be to edit the scripts manually,
> and that's the last thing I want to do honestly, in the playing with
> fire category serialized strings are pretty high ranked.
>
> Patching __wakeup handling could be a non-costly option I suppose, but
> that's just another hack on top of the hackish hacks, and I don't want
> to be the cause of it, so if unserialize can't be fixed I'd rather
> have nothing.
>
> Cheers,
> Jordi
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>