Login   Register  
PHP Classes
elePHPant
Icontem

Class: PHON

Recommend this page to a friend!
Stumble It! Stumble It! Bookmark in del.icio.us Bookmark in del.icio.us
  Classes of Martin Alterisio  >  PHON  >  Download .tar.gz .zip  >  Support forum Support forum (1)  >  Blog Blog  >  RSS 1.0 feed RSS 2.0 feed Latest changes  
Name: PHON
Support forum Support forum
Base name: phon
Description: Unserialize values exported with var_export
Related classes: , , , , , , ,
Version: 1.0.0
PHP version: 5.0
License: GNU Lesser General Public License (LGPL)
All time users: 208 users
All time rank: 6041
Week users: 1 user
Week rank: 2503
Picture of Martin Alterisio
Author: Martin Alterisio <e-mail contact>
Packages: 5 Browse this author's classes Browse this author's classes
Country: Argentina Argentina - PHP jobs in Argentina
Age: 28
All time rank: 6948 in Argentina Argentina
Week rank: 480 Up3 Up in Argentina Argentina
Innovation award
Innovation award
Nominee: 5x


  Detailed description  
This class can be used to securely unserialize values exported with PHP var_export function.

var_export is a PHP function that can be used to export variable values as text string.

The exported data can be used as an alternative to XML or JSON to pass complex data values between the same or different computers. Thus the name PHP Object Notation: PHON (pronounced like font but silencing the ending "t" sound).

This class can use the eval function to unserialize and restore the original values exported with var_export.

Alternatively, it can also parse the expression and unserialize it securely by disallowing non-constant expressions in the exported values that could be used to run dangerous arbitrary PHP code.

 

  Groups  
Group folder image PHP 5 Classes using PHP 5 specific features View top rated classes
Group folder image Data types Modeling and manipulating data types View top rated classes
Group folder image Security Security protection and attack detection View top rated classes

  Rate classes User ratings   Trackback   Applications   Files Files  

  Innovation Award  
PHP Programming Innovation award nominee
April 2008
Number 3
 Serializing a variable value is a way to convert any type of variable into a single string that can be stored in a file, a database or sent to another application or another server, in a way that the original variable value can be easily restored.

One easy way convert the value of any variable into a single human-readable string is to use the PHP var_export function. To unserialize a value serialized this way, PHP applications only need to use the eval function.

However, applications must be careful when using the eval function to unserialize values received from untrusted sources. The problem is that serialized values may contain arbitrary PHP code that may allow security abuses that is executed when eval is called.

This class provides a secure solution to unserialized values serialized with var_export. It uses the PHP tokenizer extension to evaluate the serialized value. This way any kind of disallowed type of expression is detected by the class.

Manuel Lemos

  User ratings  
Not yet rated by the users

  Trackback links  
Link Description
PHON: la misma idea que JSON pero para PHP Me valió un tercer puesto en los innovation awards de phpclasses...
Latest blog trackback links Latest blog trackback links

  Applications that use this class  
No application links were specified for this class.
Add link image If you know an application of this package, send a message to the author to add a link here.
  Files folder image Files  
File Role Description
Files folder imagephon (5 files)
Accessible without login Plain text file consumer.php Example Consumer example
Accessible without login Plain text file provider.php Example Provider example

  Files  /  Files folder image phon  
File Role Description
  Accessible without login Plain text file phon.lib.php Aux. Main include file for the PHON package.
  Accessible without login Plain text file InvalidPHON.php Class File for the InvalidPHON Exception.
  Accessible without login Plain text file PHONEvaluator.php Class File for the PHONEvaluator class
  Accessible without login Plain text file PHONValidator.php Class File the for PHONValidator class
  Accessible without login Plain text file SecurePHONClass.php Class The file for SecurePHONClass interface

Download all files: phon.tar.gz phon.zip
NOTICE: if you are using a download manager program like 'GetRight', please Login before trying to download this archive.