I created my own PHP template parser whereby my site uses one HTML template sprinkled with {TAGNAME} where tagname is actually different tag names that the parser will replace with functions or strings that I supply elsewhere or substitute data from MySQL database. This keeps my PHP completely separated from the HTML. All parser tags are also associated array elements. For example on my HTML template I have a tag {CRUMBS}. In a controller class I define this $tags['CRUMBS'] = “[php] return Breadcrumbs::inst();”; the inst() function simply instantiates my Breadcrumbs class. The “[php]” tells my template parser class to use the eval() function in order to treat the string as a PHP function. The end product of the function is to create a string that browsers recognize as several links of places visited on my site. My question is this: Could I have simply serialized the function instead of using eval()?

I hope I didn’t lose you.

here is a tool I often use in my job… to decode quickly serialized data… Indeed, serialised datas are good for system, but uneasy for us to read..

http://unserialize.net

Thanks again !

As a side note, unserialize() should NEVER be used on user input, as the security implications can be very serious. See SyScan / Blackhat USA 2009 and “Month of PHP Bugs”

Wow… I’m writing back to a 1 year old blog post lol