9 Feb
2011
9 Feb
'11
11:28 a.m.
Hi all
while looking at user preferences I've noticed that it uses serialize/unserialize for storing the data in database. As this functions is quite famous in terms of security, I think we should avoid this.
Any reason for not using json encoding there instead? It encodes just the data and would not possibly call PHP code as unserialize could do because of objects with __wakeup() methods.
--
Michal Čihař | http://cihar.com | http://blog.cihar.com