存储序列化数组时清理

Question

如果我将序列化数组存储到mysql数据库，应该在使用serialize函数之前或之后进行清理。或者我甚至需要消毒？

例如：

$details['name'] = mysql_real_escape_string($_POST['name']); 
$details['email'] = mysql_real_escape_string($_POST['email']); 
$details['phone'] = mysql_real_escape_string($_POST['phone']); 

$serializedDetails = serialize($details); 

// Do SQL query 

或者

$details['name'] = $_POST['name']; 
$details['email'] = $_POST['email']; 
$details['phone'] = $_POST['phone']; 

$serializedDetails = mysql_real_escape_string(serialize($details)); 

也许在第二，我可以简单地做：

$serializedDetails = serialize($details); 

Answer 1

始终使用mysql_real_escape_string与字符串处理时可能有引号/斜线。如果你不这样做，你会得到破坏/恶意查询。 serialize()的输出有时带有引号/斜杠，所以您应该使用它。不需要预先序列化数组中的每个项目。

$details['name'] = $_POST['name']; 
$details['email'] = $_POST['email']; 
$details['phone'] = $_POST['phone']; 

$serializedDetails = mysql_real_escape_string(serialize($details)); 

举一个例子：序列化“你好”会给你：s:5:"hello"。

$data = 's:5:"hello"'; 
$query = 'INSERT INTO tbl (data) VALUES ("' . $data . '")'; 

// leads to a syntax error from mysql 
// (plus it's a huge security hole) 
mysql_query($query);