So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use json_encode and json_decode.

However, after doing a few tests in a limited amount of time I have found that this isn't the case at all. For example (working Codepad example):

function e($method, $args) {
    return $method($args); 

var_dump(call_user_func_array("e", array((string)array_shift(json_decode("[\"system\"]")), "ls" )));


So, my questions are:

  1. Would you agree with me that this is not the case, and there should be more of a suggested fix rather than just using json_* functions?

  2. Am I actually correct in assuming what I have done is correct?

3 Answers 3


Unlike unserialize, if you execute json_decode alone it will not be able to instantiate any different variable types besides simple ones (e.g. arrays, string, int, float, etc), so it is fairly safe to run it with user input data.

The problem in your code is with the e function. If the parameters you pass to it come from an untrusted source such as user input, some attacker could just pass the name of a potentially dangerous function that exists in your code, so e would execute it and it could harm your application. You should never let this happen.

  • Relevant: websec.io/2014/06/13/… (see the section on "Poor unserialize handling")
    – enygma
    Jul 16, 2014 at 13:58
  • Okay, I see what you're saying. I would just like to add that the script was made to be exploitable, not to be safe :) Thanks for the answer!
    – DarkMantis
    Jul 17, 2014 at 8:41

I'm the author of the OWASP page about PHP Object Injection. Like already said by Guilherme Sehn, json_decode will not allow for object deserialization, and the snippet code you've posted contains a vulnerability which doesn't concern PHP Object Injection. So, I think it's correct to say that using JSON functions is enough to prevent object injection attacks. This should also be the reason why some time after creating that OWASP page the PHP guys have added a note on the unserialize reference page: http://php.net/manual/en/function.unserialize.php#refsect1-function.unserialize-notes


Fix for what?

Serialized objects might be usefull, but you should just never ever unserialze() user-input; this WILL fail and there WILL be a smarter guy that will find this vulnerability.

The OWASP-page is very wrong IMHO. Jt just should issue a big red warning: Don't use unserialize on user data!

Or am I wrong here?

  • A fix for preventing attackers performing PHP Object Injections.
    – DarkMantis
    Jul 16, 2014 at 7:52
  • 1
    if (raw) user-input never reaches the unserialize() function you're a lot safer Jul 16, 2014 at 8:12
  • Sure, I wouldn't do that anyway. I'm just wondering if my assumptions are correct with what I've said about the json_* functions.
    – DarkMantis
    Jul 16, 2014 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.