Is PHP Serialized Object Data Clean For Mysql Injection?

Question

Do I need to escape my object data if I'm serializing for mysql injection?

ie:

class Object
{
   public $description;
}

$obj = new Object();
$obj->description = mysql_real_escape_string("this is my crazy string with lot's of bad // characters");

$data = serialize($obj); // <-- $data will be stored in DB

or will this suffice:

class Object
{
   public $description;
}

$obj = new Object();
$obj->description = "this is my crazy string with lot's of bad // characters";

$data = serialize($obj);

FWIW, there should be no apostrophe in "lot's" so it's safe anyway. (just joking!) — Bill Karwin
– Bill Karwin, Commented Jun 30, 2010 at 23:32
@Bill lol. that's hilarious. I couldn't think of anything to write. So, you got me ;) — Howard Zoopaloopa
– Howard Zoopaloopa, Commented Jun 30, 2010 at 23:36

Artefacto · Accepted Answer · 2010-07-01 00:57:16Z

3

Yes, you must escape it (or use prepared statements).

<?php
$obj = (object) array("--'--'" => "--'--");
var_dump(serialize($obj));

yields

string(44) "O:8:"stdClass":1:{s:6:"--'--'";s:5:"--'--";}"

As you can see, there's no escaping.

On a side note, you should use the mysqli extension for new code, not the mysql extension.

edited Jul 1, 2010 at 0:57

answered Jun 30, 2010 at 23:36

Artefacto

98.1k17 gold badges207 silver badges230 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel Egeberg · Accepted Answer · 2010-06-30 23:21:50Z

2

Run mysql_real_escape_string() after you've serialized. That's the string you are going to put in the database after all.

answered Jun 30, 2010 at 23:21

Daniel Egeberg

8,38233 silver badges44 bronze badges

1 Comment

Mike Sherov Over a year ago

Always run mysql_real_escape_string on input, or better yet, use prepared statements. The more of a habit you make it, the better.

Collectives™ on Stack Overflow

Is PHP Serialized Object Data Clean For Mysql Injection?

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related