Re: [PHP-DEV] Unserialize is broken

2010-03-01 Thread Tjerk Meesters
Hi, If visibility is an issue why not just use json_enode/decode for this case then?it doesn't seem like a typical enough problem to be solved low-level and json seems fast enough for the job ;-) On 01-Mar-2010, at 4:00, Jordi Boggiano j.boggi...@seld.be wrote: On Sun, Feb 28, 2010 at

Re: [PHP-DEV] Unserialize is broken

2010-03-01 Thread Stan Vassilev
Hi, If visibility is an issue why not just use json_enode/decode for this case then?it doesn't seem like a typical enough problem to be solved low-level and json seems fast enough for the job ;-) Hi, I don't know whether it should be fixed or not, but it definitely shouldn't have

Re: [PHP-DEV] Unserialize is broken

2010-03-01 Thread Jordi Boggiano
On 01.03.2010 10:31, Tjerk Meesters wrote: If visibility is an issue why not just use json_enode/decode for this case then?it doesn't seem like a typical enough problem to be solved low-level and json seems fast enough for the job ;-) Honestly I personally don't care, it won't happen to me

Re: [PHP-DEV] Unserialize is broken

2010-03-01 Thread Scott MacVicar
Java has a transient keyword to skip serialising a property and I have a patch against 5.3 on http://whisky.macvicar.net/patches/ It might make it in to 5.4/6/next once I get some more free time. Scott On 1 Mar 2010, at 02:10, Jordi Boggiano j.boggi...@seld.be wrote: On 01.03.2010 10:31,

[PHP-DEV] Unserialize is broken

2010-02-28 Thread Jordi Boggiano
Heya, This bug was closed as Bogus http://bugs.php.net/bug.php?id=51173 and Pierre told me to bring the discussion here since I was ranting on irc. Johannes argued that the fact unserialize doesn't check the access level of properties before generating object is good because it allows hackish

Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Herman Radtke
Imo unserialize should check, when applying public or protected values, if either exists on the object, and apply it to the one that exists. Sure it's gonna cost some performance, but at least changing the prototype of your class while stuff is running isn't going to kill your code anymore.

Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Richard Quadling
On 28 February 2010 19:03, Herman Radtke hermanrad...@gmail.com wrote: Imo unserialize should check, when applying public or protected values, if either exists on the object, and apply it to the one that exists. Sure it's gonna cost some performance, but at least changing the prototype of your

Re: [PHP-DEV] Unserialize is broken

2010-02-28 Thread Jordi Boggiano
On Sun, Feb 28, 2010 at 8:03 PM, Herman Radtke hermanrad...@gmail.com wrote: Imo unserialize should check, when applying public or protected values, if either exists on the object, and apply it to the one that exists. Sure it's gonna cost some performance, but at least changing the prototype