PHP如何从序列化的mysql字符串中提取变量？答案

【问题标题】：PHP How to extract variable from serialized mysql string?PHP如何从序列化的mysql字符串中提取变量？
【发布时间】：2018-05-28 18:05:33
【问题描述】：

在一个 php 文件中，我试图在这个字符串中提取 user_name 变量

user_name|s:11:"testaccount";user_email|s:27:"testaccount@testaccount.com";user_login_status|i:1;

我不知道这是什么格式。我正在使用 php mysqli 用这个函数查询数据库

$q = "SELECT `data` FROM `sessions` WHERE `id` = '".$this->dbc->real_escape_string($cookie)."' LIMIT 1";

其中 $cookie 是客户端的 cookie。有人认得字符串的格式吗？

【问题讨论】：

只是一个快速提示。在使用 SQL 时，使用parameterized queries要安全得多。
这种格式至少对我来说是新的。家酿？猜猜你现在已经发现了如何爆发并获得你的价值？
这是一个序列化的会话。键/值对用管道分隔，值被序列化。

标签： php mysql string cookies mysqli

【解决方案1】：

姓名、邮箱和状态用分号隔开。名称和值由管道分隔。值是序列化形式。例如。用户名|s:11:"testaccount";

反序列化 s:11:"testaccount";您将获得 testaccount 价值

【讨论】：

【解决方案2】：

想通了。用这个函数来做https://gist.github.com/phred/1201412。

//
// This is the result of about an hour's delving into PHP's hairy-ass serialization internals.
// PHP provides a session_decode function, however, it's only useful for setting the contents of
// $_SESSION.  Say, for instance, you want to decode the session strings that PHP stores in its
// session files -- session_decode gets you nowhere.
//
// There are a bunch of nasty little solutions on the manual page[1] that use pretty hairy regular
// expressions to get the job done, but I found a simple way to use PHP's unserialize and recurse
// through the string extracting all of the serialized bits along the way.
//
// It's not speedy (it calls unserialize AND serialize for each session element), but it's accurate
// because it uses PHP's internal serialized object parser.  Fun trivia: PHP's serialized object
// parser is an ugly-ass little compiled regular expression engine.  But hey, it works, let's not
// reinvent this wheel.
//
// [1]: http://www.php.net/manual/en/function.session-decode.php
//

define("SESSION_DELIM", "|");

function unserialize_session($session_data, $start_index=0, &$dict=null) {
   isset($dict) or $dict = array();

   $name_end = strpos($session_data, SESSION_DELIM, $start_index);

   if ($name_end !== FALSE) {
       $name = substr($session_data, $start_index, $name_end - $start_index);
       $rest = substr($session_data, $name_end + 1);

       $value = unserialize($rest);      // PHP will unserialize up to "|" delimiter.
       $dict[$name] = $value;

       return unserialize_session($session_data, $name_end + 1 + strlen(serialize($value)), $dict);
   }

   return $dict;
}

$session_data = …; // A string from a PHP session store.

$session_dict = unserialize_session($session_data);

【讨论】：