Positives | Negatives

PHP Code:
$foo = null;
PHP value:
NULL
Unserialized in PHP:
array(0) {
}
Unserialized in JS:


PHP Code:
$foo = true;
PHP value:
bool(true)
Unserialized in PHP:
string(1) "1"
Unserialized in JS:


PHP Code:
$foo = "foobar";
PHP value:
string(6) "foobar"
Unserialized in PHP:
string(6) "foobar"
Unserialized in JS:


PHP Code:
$foo = 337;
PHP value:
int(337)
Unserialized in PHP:
string(3) "337"
Unserialized in JS:


PHP Code:
$foo = 99.99;
PHP value:
float(99.99)
Unserialized in PHP:
string(5) "99.99"
Unserialized in JS:


PHP Code:
$foo = array("a" => 1, "b" => 2, 3);
PHP value:
array(3) {
  ["a"]=>
  int(1)
  ["b"]=>
  int(2)
  [0]=>
  int(3)
}
Unserialized in PHP:
array(3) {
  ["a"]=>
  string(1) "1"
  ["b"]=>
  string(1) "2"
  [0]=>
  string(1) "3"
}
Unserialized in JS:


PHP Code:
$foo = array(1,2,array(1,2,3));
PHP value:
array(3) {
  [0]=>
  int(1)
  [1]=>
  int(2)
  [2]=>
  array(3) {
    [0]=>
    int(1)
    [1]=>
    int(2)
    [2]=>
    int(3)
  }
}
Unserialized in PHP:
array(3) {
  [0]=>
  string(1) "1"
  [1]=>
  string(1) "2"
  [2]=>
  array(3) {
    [0]=>
    string(1) "1"
    [1]=>
    string(1) "2"
    [2]=>
    string(1) "3"
  }
}
Unserialized in JS:


PHP Code:
class Foo { var $foo; var $bar; }$foo = new Foo; $foo->foo = "hello"; $foo->bar = array("world","universe");
PHP value:
object(Foo)#2 (2) {
  ["foo"]=>
  string(5) "hello"
  ["bar"]=>
  array(2) {
    [0]=>
    string(5) "world"
    [1]=>
    string(8) "universe"
  }
}
Unserialized in PHP:
array(2) {
  ["foo"]=>
  string(5) "hello"
  ["bar"]=>
  array(2) {
    [0]=>
    string(5) "world"
    [1]=>
    string(8) "universe"
  }
}
Unserialized in JS:


Positives | Negatives

Invalidly serialized:
x
Unserialized in JS:


Invalidly serialized:
x-1
Unserialized in JS:


Invalidly serialized:
x=1x=2
Unserialized in JS:


Invalidly serialized:
x=1&
Unserialized in JS:


Invalidly serialized:
x[=]1
Unserialized in JS:


Invalidly serialized:
[]x=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX]]=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[[=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX][=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[=]1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[=1]
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[0]=1&_HTML_AJAX]]=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[0[1]]=1
Unserialized in JS:


Invalidly serialized:
_HTML_AJAX[0[1]=1
Unserialized in JS: