php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #45816 serialize() modifies objects
Submitted: 2008-08-14 07:37 UTC Modified: 2008-08-22 01:00 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: gmtfn at yahoo dot com Assigned: fb-req-jani (profile)
Status: No Feedback Package: Session related
PHP Version: 5.2.6 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: gmtfn at yahoo dot com
New email:
PHP Version: OS:

 

 [2008-08-14 07:37 UTC] gmtfn at yahoo dot com
Description:
------------
Calling serialize() on an object whose name is the same as the key under which it's saved in $_SESSION makes the object unusable (its methods can't be called.

If I store store a serialized version of the object under a key that's different from the name of the variable that points to the object, then everything works fine. If this is by design and must remain this way, I want to tell you that this is VERY counterintuitive and must be prominently documented.

I can reproduce this on a Linux server (with PHP 5.2.5 and 5.2.6) but not on Windows Vista.

Reproduce code:
---------------
<?php
	session_start();
	ob_start();

	class GoodObject {
		private $count = 0;
		public function doSmth()
		{
			echo "$this->count <br>";
			$this->count++;
		}
	}

	if(!isset($_SESSION['myObj'])) {
		$myObj = new GoodObject();
	}
	else {
		$s = $_SESSION['myObj'];
		$myObj = unserialize($s);
	}
	
	$myObj->doSmth();
	$s = serialize($myObj);
	$_SESSION['myObj'] = $s;
	$myObj->doSmth(); // this fails on the second page load
?>

Expected result:
----------------
Converting an object to a string should not change the object, and the last statement in this script should output the value of $count.

Actual result:
--------------
On the second load of the page, I get this:

Fatal error: Call to a member function doSmth() on a non-object in [path to the file] on line 26

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-08-14 07:48 UTC] gmtfn at yahoo dot com
line 25, not 26
 [2008-08-14 17:42 UTC] jani@php.net
Check your phpinfo() output that register_globals is Off.
 [2008-08-14 23:04 UTC] gmtfn at yahoo dot com
register_globals is on on Linux servers and off on Vista. But whatever its value is, getting a string representation of an object, which serialization is, shouldn't change the object. It's completely counterintuitive, and I can't imagine a valid reason for ruining a still perfectly usable object. It's analogous to changing a variable's type just because it's been typecasted to something else.
 [2008-08-22 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Dec 27 19:01:28 2024 UTC