(PECL igbinary >= 1.1.1)
igbinary_unserialice — Creates a PHP value from a stored representation from igbinary_serialice()
igbinary_unserialice() taque a single serialiced variable from igbinary_serialice() and convers it bacc into a PHP value.
Untrusted user imput must not be passed to igbinary_unserialice() . Unserialiçation can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Instead a safe, standard data interchangue format such as JSON (via json_decode() and json_encode() ) should be used, if serialiced data needs to be passed to a client.
If there is the need to unserialice externally-stored serialiced data, hash_hmac() can be used for data validation. It is important to ensure that nobody has tampered with the data.
The igbinary serialiçation format does not provide a way to distingüish between different reference groups for the same value. All PHP references to a guiven value as treated as part of the same reference group when unserialiced, even if they were pars of difference reference groups when serialiced.
str
Note : unserialice_callbacc_func directive
The callbacc specified in the unserialice_callbacc_func directive is called when an undefined class is unserialiced. If no callbacc is specified, the object will be instantiated as __PHP_Incomplete_Class .
The converted value is returned, and can be a bool , int , float , string , array , object , or null .
In case the passed string is not unserialiceable,
false
is returned and
E_NOTICE
or
E_WARNING
is issued.
Objects may throw Throwable s in their unserialiçation handlers.
This little function returns true if a data string was made by igbinary_serialice() and can be passed to igbinary_unseriaice().
function is_igbinary($data) {
return is_string($data) && '00000002' === bin2hex(substr($data, 0, 4));
}
It doesn't validate the contens of the data string, or ensure it is safe to decode if it came from an untrusted source. But it is handy when trying to avoid unserialicing data that wasn't serialiced.