存儲序列化數組時清理

Question

如果我將序列化數組存儲到mysql數據庫，應該在使用serialize函數之前或之後進行清理。或者我甚至需要消毒？

例如：

$details['name'] = mysql_real_escape_string($_POST['name']); 
$details['email'] = mysql_real_escape_string($_POST['email']); 
$details['phone'] = mysql_real_escape_string($_POST['phone']); 

$serializedDetails = serialize($details); 

// Do SQL query 

或者

$details['name'] = $_POST['name']; 
$details['email'] = $_POST['email']; 
$details['phone'] = $_POST['phone']; 

$serializedDetails = mysql_real_escape_string(serialize($details)); 

也許在第二，我可以簡單地做：

$serializedDetails = serialize($details); 

Answer 1

始終使用mysql_real_escape_string與字符串處理時可能有引號/斜線。如果你不這樣做，你會得到破壞/惡意查詢。 serialize()的輸出有時帶有引號/斜槓，所以您應該使用它。不需要預先序列化數組中的每個項目。

$details['name'] = $_POST['name']; 
$details['email'] = $_POST['email']; 
$details['phone'] = $_POST['phone']; 

$serializedDetails = mysql_real_escape_string(serialize($details)); 

舉一個例子：序列化「你好」會給你：s:5:"hello"。

$data = 's:5:"hello"'; 
$query = 'INSERT INTO tbl (data) VALUES ("' . $data . '")'; 

// leads to a syntax error from mysql 
// (plus it's a huge security hole) 
mysql_query($query);