Posted by Carl on 12/29/05 03:11

jody.florian@gmail.com wrote:
> Hi there,
>
> http://uk2.php.net/setcookie
>
> suggests that for security, implode (correction of explode) should be
> used instead of serialize. Does anyone know why?
>
> I don't need to implement this, I just feel I need to know, for a
> course I'm studying.
>
> Cheers
> Jody
>

Jody,

It could be due to this:
http://www.hardened-php.net/advisory_012004.42.html
see section 6 & 7.

Cheers,
Carl.

[Back to original message]