4 ms·
PHP has this problem too - never use PHP unserialize() to unserialize hostile (i.e. user-accessible) data. It won't end well for you. I think it's true for any
by smsm42 8y ago
PHP has this problem too - never use PHP unserialize() to unserialize hostile (i.e. user-accessible) data. It won't end well for you. I think it's true for any sufficiently powerful serialization format...
- PetahNZ 8y agoHad, https://wiki.php.net/rfc/secure_unserialize https://wiki.php.net/rfc/secure_unserialize (but yes you still need to implement a safe unserialize white list)