反序列化PHP类和gz膨胀的问题


Problem with unserializing a PHP class and with gzinflate

我正在尝试序列化一个类(用户)并将其作为GET变量传递到下一页。

下面是我的测试代码:

$usr->getByLoginPass($db,"perf@stud.de","a32636ba1c7875b19c6f32121078c2da0be6f857");
$serial = $usr->serialize();
$handle = fopen("http://localhost/newClassSite/utests/userSerializationTest.php?data=$serial", "rb");
$contents = "";
while (!feof($handle)) {
    $contents .= fread($handle, 8192);
}
fclose($handle);
if(strpos($contents,"Perfect") === false) {
    echo"$contents<br>";
    echo"Problem with serialization testUser.test:16" . $usr->getLastError() . "<br>";
}
以下是userSerializationTest.php中的代码:

$data = $_GET['data'];
echo"5: $data<br>";
include('../user.inc');
$usr = new User();
$usr->deserialize($data);
$usr->printUser();
下面是类中的代码:

public function serialize() {
    $serial = serialize($this);
    $df = gzdeflate($serial);
    $b64 = base64_encode($df);
    $ue = urlencode($b64);
    echo "<font face='Courier New'>1: $serial<br><br>2: $df<br><br>3: $b64<br><br>4: $ue<hr><br>";
    return($ue);
}
public function deserialize($data) {
    $ud = urldecode($data);
    $u64 = base64_decode($ud);
    $gf = gzinflate($u64);
    $us = unserialize($gf);
    echo"6: $ud<br><br>7: $u64<br><br>8: $gf<br><br>9: $us<hr><br>";
}

输出如下:

1: O: 4:"用户":9:{s: 12:"UseruserID";销售:1:"9";销售:15:"UserstudentID";销售:3:"007";销售:11:"Useremail";销售:12:"perf@stud.de";销售:10:"Usersha1";销售:40:"a32636ba1c7875b19c6f32121078c2da0be6f857";销售:11:"Userfname";销售:7:"完美";销售:11:"Userlname";销售:7:"学生";销售:12:"Userstatus";销售:2:"OK";销售:17:"UsermiddleNames";销售:0:";销售:15:"UserlastError";销售:0:";}

2:马"= 0 @ [hÿ0º,OAxEOlOVte¼»"__ƺðI0o†Ð喜爱,·Bm¦ofEe€vª^ IuQeAIrc t/美国美元¢§÷OOi +[¥# AKIC‰ˆœ²œ5 h ^¢!•d&£"IKI Af¦,þ™Ao1"º†9祖茂堂µ¡u1UæU©Wz喜爱ð£;X@o9Š& lt;‰}«t§/!":BIoGtAu£µO»¨ÿ/

3: XZBNDsIgFIQ9CwcwQFtonxsXujAm1sR4AMpPbNJWA3RlvLuUhsa6gfDNMG + ghhzQ3WmLoIK3A0IBbabzZgzL6YB2gQGq4l4kzflR6cHPcgYIYx4NJBl0L9ouopD30tbspytbpSPDS85DkInkgYiMsow1gkhe8qIhlWQmo4QSzEtJlcCNZqYs/gaZQfQxlAO6hjla + rWh + zHc5tqpV3qL8KObWED1OYo8iX2rVKcvISI6Qs31R3TC + aO1T7uony8 =

4: XZBNDsIgFIQ9CwcwQFtonxsXujAm1sR4AMpPbNJWA3RlvLuUhsa6gfDNMG % 2 bghhzq3wmloik3a0ibbabzzgzl6yb2gqgq4l4kzflr6chpcgyiyx4njbl0l9ouopd30tbspytbpspds85dkinkgyimsow1gkhe8qihlwqmo4qszetjlccnzqys % 2 fgazqfqxlao6hjla % 2 brwh % 2 bzhc5tqpv3ql8kobwed1oyo8ix2rvkcvisi6qs31r3tc % 2 bao1t7uony8 % 3 d

5: XZBNDsIgFIQ9CwcwQFtonxsXujAm1sR4AMpPbNJWA3RlvLuUhsa6gfDNMG + ghhzQ3WmLoIK3A0IBbabzZgzL6YB2gQGq4l4kzflR6cHPcgYIYx4NJBl0L9ouopD30tbspytbpSPDS85DkInkgYiMsow1gkhe8qIhlWQmo4QSzEtJlcCNZqYs/gaZQfQxlAO6hjla + rWh + zHc5tqpV3qL8KObWED1OYo8iX2rVKcvISI6Qs31R3TC + aO1T7uony8 =

警告:gzinflation () [function.]: C:'wamp'www'newClassSite'user中的数据错误。117行6: XZBNDsIgFIQ9CwcwQFtonxsXujAm1sR4AMpPbNJWA3RlvLuUhsa6gfDNMG ghhzQ3WmLoIK3A0IBbabzZgzL6YB2gQGq4l4kzflR6cHPcgYIYx4NJBl0L9ouopD30tbspytbpSPDS85DkInkgYiMsow1gkhe8qIhlWQmo4QSzEtJlcCNZqYs/gazqfqxla6hjla rWh zhc5tqpv3ql8kobwed10yo8ix2rvkcvisi6qs31r3tc aO1T7uony8=

7:]M " =0@[hŸº0&ÖÄxÊOlÒVte¼»"†ÆºðÍ0h!‡47Zbè -ÀЀ[i¼Ùƒ2ú @j¸—‰3~Tzps܂ǃI]ö‹¨¤=ôµ»)ÊÖéHðÒóä"y b#,£ '¼'´´´eY´³Òep#Y©[?]¦P} ei¡ŽV«佐;j¥]e/毛Žæ(o %或者œ¼"ˆe7OO£µo»¨ÿ/

8:

9:

用户:ID: 1席德:电子邮件:通过:帧:lname:状态:中间:

我希望字段在最后填写。
为什么gzinflation失败了?
我遗漏了什么?

看一下3和6中的数据。它们不一样!

发生的事情是+字符作为URL中的空格,所以"+"get被解码为5和6之间的"(我猜5是原始$_GET数据,并显示它已经被解码)

deserialize()函数中不需要urldecode()。PHP在构建$_GET数组时已经处理了所有这些。这是最有可能的问题-您对数据进行了双重解码,并且随机地,一些gzdata具有字符序列,最终看起来像合法的urlencoded数据。

同样,为什么要使用<font>标记来输出调试数据?使用<pre>。它旨在以固定宽度的字体输出文本。