This is essentially the same problem, although not my use case.

var_dump(unserialize(eval('return '.var_export(serialize(chr(0)),true).';')));

Expected Result:
string(1) "[000]"

Actual Result:
bool(false)

Please try using this snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

Your first case works fine using latest SVN. The other one..I don't think is a bug anyway.

That 2nd is bogus, you forget that var_export() returns PHP code. You're doing eval() on wrong stuff. Don't eval(). Refactor your code.

thanks for checking it out.

I do not have the possibility to install a different version...but if you say it works, then we'll try again when we update to that version...it's not a critical to us at the moment, but it might become so in the future (our current solution is not to have protected members).

as for the 2nd one being bogus, i disagree;)

i shortened it down to this (no serialize).

var_export(), which should produce parseable (evaluatable) PHP-Code (as you said), creates a php-code-string, which i extend to a return statement, which I want to eval(). This is, though strange, correct.

Reproduce Code:
var_dump(eval('return '.var_export(chr(0),true).';'));

Expected Result:
string(1) "[000]"

Actual Result:
string(4) "\000"

It seems to me that var_export() is the culprit because it returns '\000' instead of "\000" (note the double-quotes) this only happens with chr(0) but works with chr(1). Could it be related to \000 being a string-termination character, which is why it is escaped by var_export but it fails to provide the correct double-quotes? Because the character \001 is not escaped by var_export...

<?
//creates correct code
var_dump(var_export(chr(1),true));

//creates incorrect code
var_dump(var_export(chr(0),true));

//evaluates correctly
var_dump(eval('return '.var_export(chr(1),true).';'));

//does not evaluate the chr(0) correctly because it's not wrapped by double-quotes
var_dump(eval('return '.var_export(chr(0),true).';'));

//is actually the same as the previous line
var_dump(eval('return \'\000\';'));

//as it should be created by var_export
var_dump(eval('return "\000";'));
?>

This works fine (5.1.7-dev, 5.2.13-dev and 5.3.2-dev):

derick@kossu:/tmp$ pe 5.1dev
derick@kossu:/tmp$ php test2.php
<pre>
Original serialize:                     string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Exported serialize:                     string(53) "'O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}'"
Evaluated Exported serialize:           string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Unserialized Exported serialize:        object(Person)#2 (1) {
  ["name:protected"]=>
  string(12) "Lars Schultz"
}
derick@kossu:/tmp$ pe 5.2dev
derick@kossu:/tmp$ php test2.php
<pre>
Original serialize:                     string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Exported serialize:                     string(75) "'O:6:"Person":1:{s:7:"' . "\0" . '*' . "\0" . 'name";s:12:"Lars Schultz";}'"
Evaluated Exported serialize:           string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Unserialized Exported serialize:        object(Person)#2 (1) {
  ["name:protected"]=>
  string(12) "Lars Schultz"
}
derick@kossu:/tmp$ pe 5.3dev
derick@kossu:/tmp$ php test2.php
<pre>
Original serialize:                     string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Exported serialize:                     string(75) "'O:6:"Person":1:{s:7:"' . "\0" . '*' . "\0" . 'name";s:12:"Lars Schultz";}'"
Evaluated Exported serialize:           string(51) "O:6:"Person":1:{s:7:"*name";s:12:"Lars Schultz";}"
Unserialized Exported serialize:        object(Person)#2 (1) {
  ["name":protected]=>
  string(12) "Lars Schultz"
}

@derick: thanks for your effort.

Just checked the changelog and found your bugfix;) sorry,...somehow escaped my search for an existing bug. sorry.

http://bugs.php.net/bug.php?id=42272