unserialize not working correctly

[TomasDR]

I am trying to use a hack that is no longer supported and the original coder isn't replying even on his own board. I am hoping someone can assist me since I am very confused about what is wrong.

I am using FC4 with updated RPMs, so PHP=5.0.4 & SQL=4.1.20, I also use MYSQLi to connect to the database.

The original code is:
$cdfield = "field" . $vbulletin->options["countdownfield"];
$query = $vbulletin->db->query_read( "SELECT $cdfield FROM " . TABLE_PREFIX . "userfield WHERE userid='" . $post["userid"] . "';" );
$result = mysql_fetch_array( $query );

$cddata = unserialize( str_replace( """, '"', $result[$cdfield] ) );

if ( $cddata["enabled"] == "Yes" )


I know $cdfield is working and returning the proper field#.

So I made this test code to figure out what is wrong:
<?php
$link = mysql_connect('localhost', 'dbname', 'dbpassword');
if (!$link) {
die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully'.'<br />';
$result = mysql_query("SELECT field10 FROM vbulletin.vb_userfield WHERE userid='3531'");
if (!$result) {
die('Invalid query: ' . mysql_error());
}
echo 'Query Results'.'<br />';
var_dump ($result);
$result2 = str_replace( "&quot;", '"', $result['field10'] );
echo '<br/>'.'Replace Results'.'<br />';
var_dump ($result2);
$serializedarray = unserialize($result2['field10']);
echo '<br/>'.'Unserialized'.'<br />';
var_dump ($serializedarray);
echo $result["enabled"];
?>


I receive:
Connected successfully
Query Results
resource(3) of type (mysql result)
Replace Results
string(0) ""
Unserialized
bool(false)

My raw data in the SQL table looks like this:
a:8:{s:7:&quot;enabled&quot;;s:3:&quot;Yes&quot;;s:3:&quot;day&quot;;s:1:&quot;1&quot;;s:5 :&quot;month&quot;;s:1:&quot;1&quot;;s:4:&quot;year&quot;;s:4:&quot;2009&quot;;s:4:&quot;hour&quot;; s:1:&quot;0&quot;;s:6:&quot;minute&quot;;s:1:&quot;0&quot;;s:5:&quot;event&quot;;s:14:&quot;Hap py New Year&quot;;s:7:&quot;overmsg&quot;;s:15:&quot;Make Resolution&quot;;}

Any help would be greatly appreciated.

[Analogpoint]

Did you try doing an unserialize on the serialized data before other manipulations such as the str_replace?

EDIT:
Also, mysql_query returns a MySQL "resource", you should pass it to one of the functions such as mysql_fetch_assoc to return a php array of the data.

<?php
$link = mysql_connect('localhost', 'dbname', 'dbpassword');
if (!$link) {
die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully'.'<br />';
$result = mysql_query("SELECT field10 FROM vbulletin.vb_userfield WHERE userid='3531'");
if (!$result) {
die('Invalid query: ' . mysql_error());
}
echo 'Result resource<br />';
var_dump ($result);

echo 'Result array<br />';
$result = mysql_fetch_assoc ($result);
var_dump ($result);

echo 'Result unserialized<br />';
$result = unserialize ($result['field10']);
var_dump ($result);

echo 'Result quotes replaced<br />';
$result = str_replace( "&quot;", '"', $result);
var_dump ($result);

?>

[Adrian Schneider]

Bingo.

Remember that a when you serialize something, PHP records the lengths of all the strings, arrays, etc. Changing things like &quot; to " would muck this up, resulting in an usable data.