This question already has an answer here:
How to secure private class field with PHP OO? I don't want to make private class field $a public, but when I do something like that:
class Hidden {
private $a = 'Very important, hidden variable';
protected $b = 'secret';
}
$obj = new Hidden();
$c = (array)$obj;
print_r($c);
$a is available for everybody:
Array ( [Hiddena] => Very important, hidden variable [*b] => secret )
</div>
分享 Perhaps you could elaborate on your concerns and give an example of a scenario where an attacker could exploit this condition in your specific case, since if anybody is able to inject PHP code into your application, you have a big problem anyway.
Access modifiers in OOP are about encapsulation, not actual security. With private, you prevent other developers from unintentionally accessing the fields, not malicious code or potential attackers.
For this reason, SecureString was introduced in C#. To emulate something like this in PHP, you'd have to store an encrypted value in $a and keep the key in a "secure" location which nobody who has the power to execute print_r or var_dump can access (file, DB). But then again, anybody who can print_r your object, can probably do file_get_contents on the key file.
分享
