Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

--TEST-- Test unserialize() with allowed_classes and subclasses --FILE-- <?php class C {}..

Decoded Output download

--TEST--
Test unserialize() with allowed_classes and subclasses
--FILE--
<?php

class C {}
class D extends C {}

$c = serialize(new C);
$d = serialize(new D);

var_dump(unserialize($c, ["allowed_classes" => ["C"]]));
var_dump(unserialize($c, ["allowed_classes" => ["D"]]));
var_dump(unserialize($d, ["allowed_classes" => ["C"]]));
var_dump(unserialize($d, ["allowed_classes" => ["D"]]));
?>
--EXPECTF--
object(C)#%d (0) {
}
object(__PHP_Incomplete_Class)#%d (1) {
  ["__PHP_Incomplete_Class_Name"]=>
  string(1) "C"
}
object(__PHP_Incomplete_Class)#%d (1) {
  ["__PHP_Incomplete_Class_Name"]=>
  string(1) "D"
}
object(D)#%d (0) {
}

Did this file decode correctly?

Original Code

--TEST--
Test unserialize() with allowed_classes and subclasses
--FILE--
<?php

class C {}
class D extends C {}

$c = serialize(new C);
$d = serialize(new D);

var_dump(unserialize($c, ["allowed_classes" => ["C"]]));
var_dump(unserialize($c, ["allowed_classes" => ["D"]]));
var_dump(unserialize($d, ["allowed_classes" => ["C"]]));
var_dump(unserialize($d, ["allowed_classes" => ["D"]]));
?>
--EXPECTF--
object(C)#%d (0) {
}
object(__PHP_Incomplete_Class)#%d (1) {
  ["__PHP_Incomplete_Class_Name"]=>
  string(1) "C"
}
object(__PHP_Incomplete_Class)#%d (1) {
  ["__PHP_Incomplete_Class_Name"]=>
  string(1) "D"
}
object(D)#%d (0) {
}

Function Calls

None

Variables

None

Stats

MD5 490a1ed36128245f9fb6e087735438c7
Eval Count 0
Decode Time 100 ms