如何捕获反序列化异常？

Question

当unserialize生成错误时,如何在PHP上捕获异常？

Answer 1

不,你不能抓住它,unserialize()不会抛出异常.

如果传递的字符串不可反序列化,则返回FALSE并发出E_NOTICE.

您可以设置自定义异常处理程序来处理所有错误:

function exception_error_handler($errno, $errstr, $errfile, $errline ) {
    throw new ErrorException($errstr, $errno, 0, $errfile, $errline);
}
set_error_handler("exception_error_handler");

Answer 2

一个简单的方法是:

$ret = @unserialize($foo);
if($ret === null){
   //Error case
}

但它不是最现代化的解决方案.

如前所述,最好的方法是拥有自定义错误/异常处理程序(不仅适用于此情况).但取决于你在做什么,这可能是矫枉过正.

Answer 3

将所有 PHP 错误（警告通知等）转换为异常。例子在这里。

Answer 4

完整的解决方案如下所示：

<?php
// As mentioned in the top answer, we need to set up 
// some general error handling
function exception_error_handler($errno, $errstr, $errfile, $errline ) {
    throw new ErrorException($errstr, $errno, 0, $errfile, $errline);
}
set_error_handler("exception_error_handler");


// Note, there are two types of way it could fail, 
// the fail2 fail is when try to unserialise just 
// false, it should fail. Also note, what you 
// do when something fails is up to your app. 
// So replace var_dump("fail...") with your 
// own app logic for error handling
function unserializeSensible($value) {
    $caught = false;
    try {
        $unserialised = unserialize($value);
    } catch(ErrorException $e) {
        var_dump("fail");
        $caught = true;
    }
    // PHP doesn't have a try .. else block like Python
    if(!$caught) {
        if($unserialised === false && $value !== serialize(false)) {
            var_dump("fail2");
        } else {
            var_dump("pass");
            return $unserialised;
        }
    }
}

unserializeSensible('b:0;'); // Should pass
unserializeSensible('b:1;'); // Should pass
unserializeSensible('a:2:{s:1:"a";b:0;s:1:"b";s:3:"foo";}'); // Should pass
unserializeSensible('a:2:{s:1:"a";b:0;s:1:"b";s:3:1111111111111111;}'); // Should fail
unserializeSensible(123); // Should fail
unserializeSensible("Gday"); // Should fail
unserializeSensible(false); // Should fail2
unserializeSensible(true); // Should fail