Read the session data from session storage file

Question

Facing problem with PHP unserialize() function as titled it is throwing error.

unserialize() [function.unserialize]: Error at offset 0 of 1781 bytes 

I also tried the session_decode() which return bool(false)

magic_quotes_gpc is Off.

Well, I am reading content of file which is serialized. File contents looks like below.

core|a:3:{s:23:"_session_validator_data";a:4:{s:11:"remote_addr";s:15:"117.241.113.248";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:90:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13";}s:13:"session_hosts";a:1:{s:12:"";b:1;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:"^@*^@_messages";a:0:{}s:20:"^@*^@_lastAddedMessage";N;}}customer|a:3:{s:23:"_session_validator_data";a:4:{s:11:"remote_addr";s:15:"117.241.113.248";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:90:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13";}s:13:"session_hosts";a:1:{s:12:"";b:1;}s:19:"wishlist_item_count";i:0;}catalog|a:3:{s:23:"_session_validator_data";a:4:{s:11:"remote_addr";s:15:"117.241.113.248";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:90:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13";}s:13:"session_hosts";a:1:{s:12:"";b:1;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:"^@*^@_messages";a:0:{}s:20:"^@*^@_lastAddedMessage";N;}}checkout|a:3:{s:23:"_session_validator_data";a:4:{s:11:"remote_addr";s:15:"117.241.113.248";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:90:"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13";}s:13:"session_hosts";a:1:{s:12:"";b:1;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:"^@*^@_messages";a:0:{}s:20:"^@*^@_lastAddedMessage";N;}}

my PHP code is below

$file='/var/www/html/products/var/session/sess_0ehb7ek0hmunqo3kq70t0t6mb0'; $contents=file_get_contents($file); $data = unserialize($contents);  var_dump($data); 

I already tried the stripslashes() before unserializing data. Not sure where is the problem in data. I can not change the mechanism of storing data in to file because this is handled by Magento for mananging session on File level.

Answer 1

If you want to decode session data, use session_decode (see the manual). unserialize only decodes single variables, not session data.

You can do something like:

$file = '/var/www/html/products/var/session/sess_ciktos8icvk11grtpkj3u610o3'; $contents = file_get_contents($file); session_start(); session_decode($contents); print_r($_SESSION); 

Answer 2

That is not legal PHP serialized data, that's PHP session data.

PHP session data uses the serialized format internally, but it is not serialized data itself.

The only thing that can safely and sanely read session data is PHP's session code. It is sometimes possible to read it using a regular expression and some creative editing, but you can not rely upon those methods.

If you need data out of a user's session, your best bet is to write a custom session wrapper and let it do the work when the data itself changes rather than try and work with the data after the fact.

(I'm not talking about custom session-writing code, I'm talking about a class that you would use instead of using $_SESSION directly.)