PHP How to extract variable from serialized mysql string? - php

Question

Within a php file I'm trying to extract the user_name var in this string
user_name|s:11:"testaccount";user_email|s:27:"testaccount#testaccount.com";user_login_status|i:1;
I can't figure out what formatting this is though. I am using php mysqli to query the database with this function
$q = "SELECT `data` FROM `sessions` WHERE `id` = '".$this->dbc->real_escape_string($cookie)."' LIMIT 1";
where $cookie is a cookie of the client. Does anyone recognize the format of the string?

Answer 1

Name , email and status are separated by semi colon. Name and value separated by pipe. Value is in serialize form.
For eg. user_name|s:11:"testaccount";
Unserialise s:11:"testaccount"; you will get testaccount value

Answer 2

Figured it out. Used this function to do it https://gist.github.com/phred/1201412.
//
// This is the result of about an hour's delving into PHP's hairy-ass serialization internals.
// PHP provides a session_decode function, however, it's only useful for setting the contents of
// $_SESSION. Say, for instance, you want to decode the session strings that PHP stores in its
// session files -- session_decode gets you nowhere.
//
// There are a bunch of nasty little solutions on the manual page[1] that use pretty hairy regular
// expressions to get the job done, but I found a simple way to use PHP's unserialize and recurse
// through the string extracting all of the serialized bits along the way.
//
// It's not speedy (it calls unserialize AND serialize for each session element), but it's accurate
// because it uses PHP's internal serialized object parser. Fun trivia: PHP's serialized object
// parser is an ugly-ass little compiled regular expression engine. But hey, it works, let's not
// reinvent this wheel.
//
// [1]: http://www.php.net/manual/en/function.session-decode.php
//
define("SESSION_DELIM", "|");
function unserialize_session($session_data, $start_index=0, &$dict=null) {
isset($dict) or $dict = array();
$name_end = strpos($session_data, SESSION_DELIM, $start_index);
if ($name_end !== FALSE) {
$name = substr($session_data, $start_index, $name_end - $start_index);
$rest = substr($session_data, $name_end + 1);
$value = unserialize($rest); // PHP will unserialize up to "|" delimiter.
$dict[$name] = $value;
return unserialize_session($session_data, $name_end + 1 + strlen(serialize($value)), $dict);
}
return $dict;
}
$session_data = …; // A string from a PHP session store.
$session_dict = unserialize_session($session_data);