Skip to main content
 首页 » 编程设计

php之如何用 php 反序列化这些数据

2024年08月29日25mfrbuaa

我有这个数据集,它可能是用 php 函数 serialize() 序列化的

C:8:"Poreikis":768:{a:14:{s:3:"_id";a:1:{s:2:"id";s:4:"5889";}s:5:"_data";a:12:{s:2:"id";s:4:"5889";s:11:"stokojantis";s:4:"2748";s:17:"parent_kategorija";s:1:"1";s:10:"kategorija";s:1:"3";s:11:"pavadinimas";s:6:"Komoda";s:9:"aprasymas";s:89:"blah blah";s:7:"pasiula";N;s:6:"active";s:1:"Y";s:10:"created_at";s:19:"2013-02-10 12:10:48";s:10:"updated_at";s:19:"2013-02-10 12:10:48";s:7:"creator";s:4:"1842";s:6:"editor";N;}s:7:"_values";a:0:{}s:6:"_state";i:3;s:13:"_lastModified";a:0:{}s:9:"_modified";a:0:{}s:10:"_oldValues";a:0:{}s:15:"_pendingDeletes";a:0:{}s:15:"_pendingUnlinks";a:0:{}s:20:"_serializeReferences";b:0;s:17:"_invokedSaveHooks";b:0;s:4:"_oid";i:2;s:8:"_locator";N;s:10:"_resources";a:0:{}}} 

我试过 unserialize() 函数:

var_dump( unserialize($var) ); 

我有这个:

PHP Warning:  Class __PHP_Incomplete_Class has no unserializer in /root/hacked.php on line 4 
object(__PHP_Incomplete_Class)#1 (1) { 
  ["__PHP_Incomplete_Class_Name"]=> 
  string(8) "Poreikis" 
} 

我也用 python 尝试过这个:

  1 #!/usr/bin/env python 
  2 # -*- coding: utf-8 -*- 
  3  
  4 import pprint 
  5 import phpserialize 
  6 from path import path 
  7 
  8 #filename   = sys.argv[1] 
  9 content     = u'_THAT_STRING_FROM_TOP' 
 10 
 11 unser = phpserialize.unserialize(content) 
 13 print unser 

明白了

~# python unserialize.py 
Traceback (most recent call last): 
  File "hacked.py", line 11, in <module> 
    unser = phpserialize.unserialize(content) 
  File "/usr/local/lib/python2.7/dist-packages/phpserialize.py", line 522, in loads 
    object_hook, array_hook) 
  File "/usr/local/lib/python2.7/dist-packages/phpserialize.py", line 512, in load 
    return _unserialize() 
  File "/usr/local/lib/python2.7/dist-packages/phpserialize.py", line 510, in _unserialize 
    raise ValueError('unexpected opcode') 

似乎该变量可能无效?好的,现在关于这个数据。

在PHP中有一个ORM引擎叫做“Doctrine”,在doctrine中有一个模型类叫做'BaseRecycleBin.php',它实际上定义了一个名为'_deleted_items'的表,它存储了这种值。我什至发现 serialization class在教义上。这似乎根本没有做任何不规则的事情。

所以主要问题是:如何反序列化这个字符串?

此外,如果可以回答,Doctrine 是否可以从该表中恢复该数据?因为这是我的初衷,从大量序列化字符串构造查询,这些字符串最初来自那个 '_deleted_items' 表。

请您参考如下方法:

PHP manual关于对象序列化(强调我的):

In order to be able to unserialize() an object, the class of that object needs to be defined. That is, if you have an object of class A and serialize this, you'll get a string that refers to class A and contains all values of variables contained in it. If you want to be able to unserialize this in another file, an object of class A, the definition of class A must be present in that file first.

您的序列化字符串包含一个 Poreikis 类型的对象,因此当您想要反序列化它时,您首先需要有可用的类型定义。

关于如何为此使用关联数组的示例:

$data = array( 
    'key1' => 'value1', 
    'key2' => 'value2', 
    'key3' => 42 
); 
// then either serialize that 
$serialized = serialize($data); 
// or make it a JSON which is supported by many languages 
$jsonencoded = json_encode($data); 

但转念一想,您的 Poreikis 似乎有一个 _data 字段,它已经是一个关联数组,似乎包含您可能需要的所有重要信息。因此,您只需访问该字段并对其进行编码,而无需手动将数据传输到新数组。