unserialize not working correctly

[TomasDR]

I am trying to use a hack that is no longer supported and the original coder isn't replying even on his own board. I am hoping someone can assist me since I am very confused about what is wrong.

I am using FC4 with updated RPMs, so PHP=5.0.4 & SQL=4.1.20, I also use MYSQLi to connect to the database.

The original code is:

    $cdfield = "field" . $vbulletin->options["countdownfield"];
    $query = $vbulletin->db->query_read( "SELECT $cdfield FROM " . TABLE_PREFIX . "userfield WHERE userid='" . $post["userid"] . "';" );
    $result = mysql_fetch_array( $query );
  
    $cddata = unserialize( str_replace( """, '"', $result[$cdfield] ) );
  
    if ( $cddata["enabled"] == "Yes" )

I know $cdfield is working and returning the proper field#.

So I made this test code to figure out what is wrong:

<?php
$link = mysql_connect('localhost', 'dbname', 'dbpassword');
if (!$link) {
   die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully'.'<br />';
$result = mysql_query("SELECT field10 FROM vbulletin.vb_userfield WHERE userid='3531'");
if (!$result) {
   die('Invalid query: ' . mysql_error());
}
echo 'Query Results'.'<br />';
var_dump ($result);
$result2 = str_replace( "&quot;", '"', $result['field10'] );
echo '<br/>'.'Replace Results'.'<br />';
var_dump ($result2);
$serializedarray = unserialize($result2['field10']);
echo '<br/>'.'Unserialized'.'<br />';
var_dump ($serializedarray);
echo $result["enabled"];
?>

I receive:

Connected successfully
Query Results
resource(3) of type (mysql result) 
Replace Results
string(0) "" 
Unserialized
bool(false)

My raw data in the SQL table looks like this:

a:8:{s:7:"enabled";s:3:"Yes";s:3:"day";s:1:"1";s:5:"month";s:1:"1";s:4:"year";s:4:"2009";s:4:"hour";s:1:"0";s:6:"minute";s:1:"0";s:5:"event";s:14:"Happy New Year";s:7:"overmsg";s:15:"Make Resolution";}

Any help would be greatly appreciated.

[Analogpoint]

Did you try doing an unserialize on the serialized data before other manipulations such as the str_replace?

EDIT:
Also, mysql_query returns a MySQL "resource", you should pass it to one of the functions such as mysql_fetch_assoc to return a php array of the data.

PHP Code:

<?php
$link = mysql_connect('localhost', 'dbname', 'dbpassword');
if (!$link) {
   die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully'.'<br />';
$result = mysql_query("SELECT field10 FROM vbulletin.vb_userfield WHERE userid='3531'");
if (!$result) {
   die('Invalid query: ' . mysql_error());
}
echo 'Result resource<br />';
var_dump ($result);

echo 'Result array<br />';
$result = mysql_fetch_assoc ($result);
var_dump ($result);

echo 'Result unserialized<br />';
$result = unserialize ($result['field10']);
var_dump ($result);

echo 'Result quotes replaced<br />';
$result = str_replace( "&quot;", '"', $result);
var_dump ($result);

?>

[Adrian Schneider]

Bingo.

Remember that a when you serialize something, PHP records the lengths of all the strings, arrays, etc. Changing things like " to " would muck this up, resulting in an usable data.