That one time I reverse engineered array-serialization

array-serialization-php.php

<?php

// a:0:{}
// a:1:{i:0;i:5694;} // add 5694
// a:2:{i:0;i:5694;i:1;i:5934;} // add 5934
// a:3:{i:0;i:5694;i:1;i:5934;i:2;i:5608;} // add 5608
// a:2:{i:0;i:5694;i:2;i:5608;} remove 5934
// a:3:{i:0;i:5694;i:1;i:5608;i:2;i:5934;} readd 5934

$str = 'a:3:{i:0;i:5694;i:1;i:5934;i:2;i:5608;}';
$str2 = 'a:2:{i:0;i:5694;i:2;i:5608;}';
$post_id = 5934;

function update_protected_posts_list($add_remove, $post_id, $cur_list) {

    $a_count = explode(':', $cur_list)[1];

    if ($a_count == 0 && $add_remove == 'remove') {
        return; // shouldn't happen
    }

    $bracket_conts = explode('}', explode('{', $cur_list)[1])[0];
    $count_post_pairs = explode(';', $bracket_conts);
    $id_counter = 0;
    $expected_count = count($count_post_pairs) - 1;
    $pair_counter = -1;
    $run_counter = 0;
    $new_str = "";

    foreach ($count_post_pairs as $count_post_pair) {
        $run_counter++;
        $pair_counter++;
        if ($pair_counter == 1) {
            // check if remove
            if ($add_remove == 'remove') {
                if (strpos($count_post_pair, (string)$post_id)) {
                    $left_rem_str = explode('i:' . (string)$post_id . ';', $bracket_conts)[0];
                    $left_rem_str_count = strlen($left_rem_str);
                    $left_sub_str = "";
                    for ($i = $left_rem_str_count - 1; $i > 0; $i--) {
                        if ($left_rem_str[$i] != 'i') {
                            $left_sub_str = $left_rem_str[$i] . $left_sub_str;
                        }
                        else {
                            $left_sub_str = $left_rem_str[$i] . $left_sub_str;
                            break;
                        }
                    }
                    // combine and str_replace
                    $bracket_conts = str_replace($left_sub_str . 'i:' . (string)$post_id . ';', '', $bracket_conts);
                    $new_str = $bracket_conts;
                }
            } else {
                // echo $count_post_pair . "\r\n";
                $new_str .= $count_post_pair . ';';
                $id_counter++;
            }
            // reset
            $pair_counter = -1;
        } else {
            if ($count_post_pairs > $run_counter)
            $new_str .= 'i:' . $id_counter . ';';
        }
    }

    if ($add_remove == 'remove') {
        $a_count = $a_count - 1;
        $new_str = 'a:' . $a_count . ':{' . $bracket_conts . '}';
    }
    else if ($add_remove == 'add') {
        $a_count = $a_count + 1;

        $new_str = 'a:' . $a_count . ':{' . $new_str . 'i:' . (string)$post_id . ';}';
    }

    return $new_str;

}

echo $str . "\r\n";
$removed = update_protected_posts_list("remove", 5934, $str);
echo $removed . "\r\n";
$added = update_protected_posts_list("add", 5934, $removed);
echo $added . "\r\n";
$removed = update_protected_posts_list("remove", 5934, $added);
echo $removed . "\r\n";
$added = update_protected_posts_list("add", 5934, $removed);
echo $added . "\r\n\r\n";

// holy shit..., it's just serializing an array wow...
echo "using built in serialize/unserialize" . "\r\n";
echo $str . "\r\n";
$a_simple_array = (unserialize($str));
// remove
if ($key = strpos($str, (string)$post_id) !== false) {
    unset($a_simple_array[$key]);
    $a_simple_array_reorder = array_values($a_simple_array);
}
echo serialize($a_simple_array_reorder) . "\r\n";
// add
array_push($a_simple_array, $post_id);
echo serialize($a_simple_array);

// output comparison

a:3:{i:0;i:5694;i:1;i:5934;i:2;i:5608;}
a:2:{i:0;i:5694;i:2;i:5608;}
a:3:{i:0;i:5694;i:1;i:5608;i:2;i:5934;}
a:2:{i:0;i:5694;i:1;i:5608;}
a:3:{i:0;i:5694;i:1;i:5608;i:2;i:5934;}

// using built in serialize/unserialize
a:3:{i:0;i:5694;i:1;i:5934;i:2;i:5608;}
a:2:{i:0;i:5694;i:1;i:5608;}
a:3:{i:0;i:5694;i:2;i:5608;i:3;i:5934;}