PHP unserialize error at offset, works on some servers, not others

Question

I have code that works on a handful of servers, but not others which is coming up with serialised data. I call a page like this:

http://domain/index.php/sales/Drilldowns?params=a:12:{s:13:"selectionType";s:8:"facility";s:8:"dateType";s:5:"daily";s:10:"dateOption";s:9:"drilldown";s:6:"metric";s:13:"bookingAmount";s:9:"companyFK";s:2:"11";s:10:"facilityFK";s:0:"";s:7:"classFK";s:0:"";s:15:"customDateStart";s:4:"null";s:7:"newDate";s:10:"2010-11-01";s:10:"metricName";s:10:"Bookings%20$";s:16:"currentDateRange";s:10:"11/01/2010";s:23:"currentMetricNavigation";s:8:"DELDELTE";}&getExcel=0

This is the code I'm using:

protected function getRequestVariables(){
        if(isset($_REQUEST['params'])){
            var_dump($_REQUEST['params']);
            echo 'length:'.strlen($_REQUEST['params']);
            $vars = unserialize($_REQUEST['params']);
            var_dump($vars);
        } else {
            $vars = $_REQUEST;
            // unset saved drilldown options
            $this->ci->session->svar_set('postVars', null);
        }

This is a var_dump output:

string(447) "a:12:{s:13:\"selectionType\";s:8:\"facility\";s:8:\"dateType\";s:5:\"daily\";s:10:\"dateOption\";s:9:\"drilldown\";s:6:\"metric\";s:13:\"bookingAmount\";s:9:\"companyFK\";s:2:\"11\";s:10:\"facilityFK\";s:0:\"\";s:7:\"classFK\";s:0:\"\";s:15:\"customDateStart\";s:4:\"null\";s:7:\"newDate\";s:10:\"2010-11-01\";s:10:\"metricName\";s:10:\"Bookings $\";s:16:\"currentDateRange\";s:10:\"11/01/2010\";s:23:\"currentMetricNavigation\";s:8:\"DELDELTE\";}"

When that gets processed I get the following error:

A PHP Error was encountered
Severity: Notice Message: unserialize() [function.unserialize]: Error at offset 6 of 447 bytes
Filename: plugins/Drilldowns.php
Line Number: 93

I'm trying this on 5.2.13 - works on some Linux, some OS X, not others. Have checked php.ini, charset (I think) - I can't figure it out for the life of me. I've tried things as simple as

string(18) "a:1:{s:3:\"sam\";}" length:18

and it still errors. Any clue as to why?

Answer 1

It's the backslashes in front of the quotes: \"

When you remove them, it works.

var_dump(unserialize('a:12:{s:13:"selectionType";s:8:"facility";s:8:"dateType";s:5:"daily";s:10:"dateOption";s:9:"drilldown";s:6:"metric";s:13:"bookingAmount";s:9:"companyFK";s:2:"11";s:10:"facilityFK";s:0:"";s:7:"classFK";s:0:"";s:15:"customDateStart";s:4:"null";s:7:"newDate";s:10:"2010-11-01";s:10:"metricName";s:10:"Bookings $";s:16:"currentDateRange";s:10:"11/01/2010";s:23:"currentMetricNavigation";s:8:"DELDELTE";}"'));

The servers this works on, probably have magic quotes turned on.

Answer 2

I had this problem and it took me a while to solve it. I just couldn't find any good solution but this is what I did to solve my situation:

 base64_encode(serialize($User)); // make sure to encode the serialized object
 unserialize(base64_decode($User)); // decode it before unserializing