Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54725
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CA+p1TcZ-_X7x7VdkhjeY86vC67PNmoZ93BcwuJ2uKdWJzhvFLQ@mail.gmail.com>
References: <CAKxcST-n_aC1NJ8pLg5natwRRcxEHV_t-fiEhYX4mc=G7WPFaA@mail.gmail.com>
	<4E4E48F6.8010107@php.net>
	<CAEZPtU5uRFO+mhQTJDZm32_Y7k6p9HzZmn1YiRmW4iZQrmht9A@mail.gmail.com>
	<CAKxcST9AYTb+SJJydb0u5RK+XgP7og8KqH+1u-7trDrSJBPOKA@mail.gmail.com>
	<CAH-PCH56zYkJH8BaGHdKTUmBm6V+k_yxKfAVp9XuES_B5ps5CQ@mail.gmail.com>
	<CA+p1TcZ-_X7x7VdkhjeY86vC67PNmoZ93BcwuJ2uKdWJzhvFLQ@mail.gmail.com>
Date: Fri, 19 Aug 2011 14:40:44 +0200
Message-ID: <CAH-PCH7xRmE2Uc2smRtBiRyyxzvhBWux7E8naAV_0+y-9dv6Qg@mail.gmail.com>
To: Arpad Ray <arraypad@gmail.com>
Cc: Paul Dragoonis <dragoonis@gmail.com>, Pierre Joye <pierre.php@gmail.com>, 
	Sebastian Bergmann <sebastian@php.net>, internals@lists.php.net
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Activation of IGBinary serialization extension in 5.4
 by default
From: tyra3l@gmail.com (Ferenc Kovacs)

On Fri, Aug 19, 2011 at 2:31 PM, Arpad Ray <arraypad@gmail.com> wrote:
> On Fri, Aug 19, 2011 at 1:04 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
>> this could still cause problems, as pointed out before (when you
>> change your handler, or when you pass serialized data between
>> different php installs, etc.), so I really like what Kiall Mac Innes
>> suggested: prefix the data with the serializer identifier.
>> if it is missing, =C2=A0then it was serialized with the old method, if i=
t
>> is present, the appropriate method should be used, if the serializer
>> ident is there but unknown, then exit with a fatal error telling the
>> user that the custom handler is missing.
>
> This came up when we discussing changing the default session
> serialization format a while ago. A prefix is a nice idea but care
> would have to be taken not to collide with any of the bytes which are
> valid for the current format to start with.
>
> Might be more of a curiosity than anything useful, but IIRC
> unserialize() currently ignores everything after the end of the data.
>
>> the downside would be that if you want to serialize/unserialize the
>> data outside of php, your implementation should take care of this
>> prefix.
>> just a wild idea, but maybe useful:
>> instead of creating a prefix, we could serialize the passed data with
>> the given(php, igbinary, etc.) handler, then wrap the whole stuff into
>> an array which holds the name of the used handler and the serialized
>> data, and serialize this array with the old(php) serialize method.
>> this way the datablob would be always a valid serialized string, and
>> would be easier to get the serialize method than with the prefixing.
>
> If my old app couldn't read some newly serialized string, I'd rather
> it failed hard than apparently succeed but have the wrong data.
>

http://php.net/unserialize
In case the passed string is not unserializeable, FALSE is returned
and E_NOTICE is issued.
so if you unserialize from php, my suggestion would fail harder.
when you unserialize it from another mean (parsing it on your own, or
from a different language), you are right, it would produce a valid
but different result what you would expect, but this could be
documented, and I don't think that that many users do this, and maybe
they are using json/bson/igbinary already.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu