3 ms·
I wonder what's the use case for serializing and unserializing objects using php built-in functions. Is this some kind of "I'm too lazy to json encode a subset
by hdhzy 10y ago
I wonder what's the use case for serializing and unserializing objects using php built-in functions. Is this some kind of "I'm too lazy to json encode a subset of properties" or are there some edge cases where one would use this extremely sharp knife?
- stephenr 10y agoSharp knives are the least dangerous if you're cutting something. A sharp knife will just cut the thing. A dull/less sharp knife will not cut, causing you to add more pressure, causing the knife to slip, which is when you're more likely to cause yourself harm.
- hdhzy 10y agoGood point.
- throwanem 10y agoThere are cases in which one might use it, but no cases in which one should.
- somebehemoth 10y agoIf you have completely sanitized data what is the problem with object serialization? Thank you.
- hdhzy 10y agoI think the problem lies somewhere inside "completely sanitized data"."If you have them completely sanitized it usually is not what many would call object serialization (php unserialize) but rather a data format (JSON).
- throwanem 10y agoThe only reliable way to sanitize PHP-serialized data is to unserialize it, scrub it, and reserialize it. This poses a nigh intractable chicken-egg problem, and makes a switch to JSON by far a more economical option.
- laurent123456 10y agoHe mentions that they think it might have a negative effect on performance. But more probably they just don't want to refactor their spaghetti code to properly handle serialized data, so instead they go for quick fixes.
- mgkimsal 10y agojson_encode didn't exist when sugarcrm was initially developed. whether they should have changed it later or not is a different question, but there was nothing else to go with at the start.
- supergreg 10y agoI've seen other projects like Doctrine2 ORM serialize arrays using the built-in serialize function too. I guess/hope they sanitize input beforehand.