Unserialize PHP Data in Python

Unserialize PHP data in python

Are you looking for phpserialize?

how to unserialize this data with php?

PHP manual on object serialization (emphasis mine):

In order to be able to unserialize() an object, the class of that object needs to be defined. That is, if you have an object of class A and serialize this, you'll get a string that refers to class A and contains all values of variables contained in it. If you want to be able to unserialize this in another file, an object of class A, the definition of class A must be present in that file first.

Your serialized string contains an object of type Poreikis, so when you want to unserialize it, you first need to have that type definition available.

An example of how you could just use an associative array for this:

$data = array(
    'key1' => 'value1',
    'key2' => 'value2',
    'key3' => 42
);
// then either serialize that
$serialized = serialize($data);
// or make it a JSON which is supported by many languages
$jsonencoded = json_encode($data);

On a second thought though, your Poreikis seems to have a _data field which already is an associative array and seems to contain all the important information you probably want. So you can just access that field and encode that instead of manually transferring your data to a new array.

Python unserialize PHP session

The default algorithm used for PHP session serialization is not the one used by serialize, but another internal broken format called php, which

cannot store numeric index nor string index contains special characters (| and !) in $_SESSION.

---

The correct solution is to change the crippled default session serialization format to the one supported by Armin Ronacher's original phpserialize library, or even to serialize and deserialize as JSON, by changing the session.serialize_handler INI setting.

I decided to use the former for maximal compatibility on the PHP side by using

ini_set('session.serialize_handler', 'php_serialize')

which makes the new sessions compatible with standard phpserialize.

Python: unserialize PHP array with regex

Update: updated to handle correctly also escaped quotes \" (actually written \\") and any escaped sequence (as an escaped quotes after an escaped escape\\\" that is \\\\\\").

---

I think, if i understood correctly the structure of your input, that you can rewrite your method as this:

def unserialize_array(serialized_array):
    import re
    return dict(enumerate(re.findall(r'"((?:[^"\\]|\\.)*)"', serialized_array)))

Assumed input (as is not specified explicitly in your question):

a:3:{i:1;s:9:"industry\\\\\\"A\\"";i:2;s:9:"\\"industry2\\"";i:3;s:9:"industry3"}

Output

{0: 'industry1\\\"A\"', 1: '\"industry2\"', 2: 'industry3'}

(actually: {0: 'industry1\\\\\\"A\\"', 1: '\\"industry2\\"', 2: 'industry3'})

How it works

There is no need to match the entire structure of the serialized array, cause we are interested only for the string contents. The regex "((?:[^"\\]|\\.)*)" simply extract per char till encounter an escape '\' (in that case accept escape + another char) or the closing double quotes ".

The capturing group assure that the double quotes are removed in the final result.

Finally the re.findall method returns in one single call a list of strings composed by our desired results.

This is a peculiarity of re.findall that overrides the entire match if at least a capturing group is present the matches (or by the capturing group in our case). Infact the docs declares:

If one or more groups are present in the pattern, return a list of groups; this will be a list of tuples if the pattern has more than one group.

How to read/make sense of a PHP serialised data string in python

phpserialize:

a port of the serialize and unserialize functions of php to python. This module implements the python serialization interface (eg: provides dumps, loads and similar functions)...

How to unserialize data array from database to html format

change unserialize() <td> code like below:

<td>
  <?php 
    $data = unserialize($notif->data)
    echo (count($data) > 1) ? implode(' : ', $data) : implode('', $data); ?>
</td>

Rest is good in your code

---

Related Topics