无法从数据库中检索序列化数据

Question

I'm able to update using serialize data into database properly but I am not able to retrieve it properly. Its echoing just Array when I try to unserialize and retrieve it from database.

Here is how I update using serialize:

$query ="Update dashboard_widget_users set dashboard_widget_users.configuration='".serialize($tmp)."' where dashboard_widget_users.dsnr_yw_user =12 and dashboard_widget_users.dsnr_dashboard_widget=1";

Result:

a:4:{i:0;s:30:""Anzahl_Fahrzeuge_ohne_Bilder"";i:1;s:22:""Fahrzeuge_ohne_Preis"";i:2;s:23:""Fahrzeuge_mit_Fehlern"";i:3;s:19:""Herausforderungen"";}

This is how I tried to unserialize() and retrieve it from database but am not getting any output properly:

$config= unserialize($row['configuration']);
echo $config['configuration'];

Here is my code:

if($param['aktion'] == 'save-widget-vehicle')
{
    $page['register-fahrzeuge'] = array(
        1   => array( 'Fahrzeug','aktiv',$page['script'],''),
        0   => array( 'Edit-Fahrzeug','enabled',$page['script'],'',''), 
    );

        $opts = !empty($param['filterOpts']) ? $param['filterOpts'] : array();

      $tmp = array();
      foreach ($opts as $opt) {
            $tmp[] = '"'.$opt.'"';
      }
      $data = array();

     $query ="UPDATE dashboard_widget_users w SET w.configuration=\"".mysql_real_escape_string(serialize($tmp))."\" WHERE w.dsnr_yw_user =12 AND w.dsnr_dashboard_widget=1";            
     $result = mysql_query($query, $myConnection);

        $html = '<table width="538" cellspacing="0" cellpadding="0" border="0">
                <tr>
                    <td>
                        <div>'.CreateRegister($page['register-news']).'</div>
                        '.CreateMessage().'
                        <div class="cont-liste-verlauf register"> 
                        <table id="fahrzeuge"> 

                                        <tr>
                                    <td>                                        

                                    </td>                               
                            </tr>                               


                        </table>            
                    </div>
                </td>
            </tr>
        </table>';


                    $return = array(
            'status' => 1,
            'html'  => $html
        );

    echo json_encode($return);
    die();

     $param['aktion'] = 'get-widget-vehicle';
}


if($param['aktion'] == 'get-widget-vehicle')
{
    $page['register-fahrzeuge'] = array(
        1   => array( 'Fahrzeug','aktiv',$page['script'],''),
        0   => array( 'Edit-Fahrzeug','enabled',$page['script'],'',''), 
    );

                $data = array();

                    $opts = !empty($param['filterOpts']) ? $param['filterOpts'] : array();

                $tmp = array();
                foreach ($opts as $opt) {
                $tmp[] = '"'.$opt.'"';
                }

            $query ='SELECT dashboard_widget_users.configuration
                                         FROM dashboard_widget_users
                                         INNER JOIN yw_user ON dashboard_widget_users.dsnr_yw_user = yw_user.intern
                                         INNER JOIN dashboard_widget ON dashboard_widget_users.dsnr_dashboard_widget = dashboard_widget.id
                                         WHERE dashboard_widget_users.dsnr_yw_user =12 AND dashboard_widget.id =1';  
        $result = mysql_query($query, $myConnection);

      /*while ($row = mysql_fetch_assoc($result)) {
        if($row['name'] == 'Anzahl_Fahrzeuge_mit_und_ohne_Bilder')
        {
            $sql = 'SELECT * FROM amo_bilder_live l LEFT JOIN afzdaten a ON l.dsnr_afzdaten = a.dsnr WHERE l.dsnr_afzdaten IS NULL';
            $sql_result=mysql_query($sql);
            //get result...
            // $row['number'] = $result
        }
        $data[] = $row;
    }*/

        $html = '<table width="538" cellspacing="0" cellpadding="0" border="0" >
            <tr>
                <td>
                <div>'.CreateRegister($page['register-fahrzeuge']).'</div>
                '.CreateMessage().'
                <div class="cont-liste-verlauf register"> ';
                while ($row = mysql_fetch_assoc($result)) {
                    $config= unserialize($row['configuration']);
                    //$config= $row['configuration'];               
                    $html .= '<table id="fahrzeuge"> 
                                <a href="amo_fahrzeuge.php"> '. $config .'</a>                  
                    </table>';
                }
            $html .= '</div>

            </td>
        </tr>
    </table>';

    $return = array(
        'status' => 1,
        'html'  => $html
    );

    echo json_encode($return);
    die();

}

Answer 1

You always escape a string depending on where it is going so you use mysqli_real_escape_string() on a value before putting it into the database - not when you are retrieving it from the database:

 $row=mysqli_fetch_assoc($result);
 $config=unserialize($row['config']);

You've tagged this with jsonserializer - but you are using PHP serialization here.