unserialize() on untrusted data
Why it matters
unserialize() can create any object, and attackers chain existing classes (gadgets) to delete files or run code. JSON only ever produces plain data.
$prefs = unserialize($_COOKIE['prefs']);$prefs = json_decode($_COOKIE['prefs'] ?? '{}', true) ?: [];How to fix
Use json_decode() instead. If you must unserialize, pass ['allowed_classes' => false].
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.