title: How secure is PHP object serialization and is it safe to pass across pages? (Using phpXMLrpc)
body: <p>Basically this is what I am doing:</p>
  
  <p>Im using PHPXMLRPC to communicate with Odoo. </p>
  
  <p>In essence to communicate for every request I need to send over needs to follow this structure:</p>
  
  <pre><code>//The database I wish to connect too
  $msg-&gt;addParam(new xmlrpcval($this-&gt;dbname, "string"));
  
  //The logged in user id
  $msg-&gt;addParam(new xmlrpcval($this-&gt;userID, "int"));
  
  //The logged in users password
  $msg-&gt;addParam(new xmlrpcval($this-&gt;password, "string"));
  
  //The model
  $msg-&gt;addParam(new xmlrpcval("project.project", "string"));
  
  //The method Im requesting to call
  $msg-&gt;addParam(new xmlrpcval("read", "string")); 
  
  //Query parameters
  $msg-&gt;addParam(new xmlrpcval($id_list, "array")); 
  $msg-&gt;addParam(new xmlrpcval($field_list, "array")); 
  </code></pre>
  
  <p>Now I have written a class which in its constructor sets the instance variables to that of the values passed into its constructor i.e</p>
  
  <pre><code>class PHPClient{
     private $userName;
     private $password;
     private $dbname;
     private $server_url;
     private $userID;
  
  
  
  public function __construct($server_url, $database, $user, $password)
  {
      $this-&gt;server_url = $server_url;
      $this-&gt;dbname = $database;
      $this-&gt;userName = $user;
      $this-&gt;password = $password;
      $this-&gt;userID = False;
  
  
  }
  </code></pre>
  
  <p>There are occasions where I wish to use the same object again somewhere else down the line, perhaps in another page. Instead of asking the user to effectively "login" again and enter all their details again and then having to  create another object would it be safe enough to serialize the PHPClient object and store in a session then in any other pages where I require use of that object in order to verify that the user is logged in and has sufficient permission, then deserialize the object to carry out any further RPC requests?</p>