access_property.php

<?php

// Access a property with no restrictions
function stole($object,$property){
	$dict = (array)$object;
	$class = get_class($object);
	return isset($dict[$property])?
		$dict[$property]:(isset($dict["\0*\0$property"])?
		$dict["\0*\0$property"]:(isset($dict["\0$class\0$property"])?
		$dict["\0$class\0$property"]:null));
}


// Modify a property with no restrictions
function inject(&$object,$property,$value){
	$dict = (array)$object;
	$class = get_class($object);
	if (isset($dict["\0$class\0$property"])) {
		$dict["\0$class\0$property"] = $value;
		$object = castToClass($dict,$class);
	} elseif (isset($dict["\0*\0$property"])) {
		$dict["\0*\0$property"] = $value;
		$object = castToClass($dict,$class);
	} elseif (isset($dict[$property])) {
		$object->$property = $value;
	} else {
		return ;
	}
}

// Required because we don't know if className has a __set_state defined.
function castToClass(array $array,$className) {
    return unserialize(
	'O:'.strlen($className).':"'
	.$className.'"'.strstr(serialize($array), ':')
    );
}


// Example

class Safe {
	private $content = 'gold';
}

$mySafe = new Safe();

// Inject value into a private property
inject($mySafe,'content','Magic!');


echo "I've robbed your ",stole($mySafe,'content'),"!";