Decoding raw PHP session values

Drupal overrides PHP's session handler and stores all sessions in its own sessions table. Normally, you should never be accessing that table directly since the session info is automatically loaded when it is initialized by a user.

Some time ago though, we needed direct access to the session table and found out this isn't as easy as it seems. The session variables are stored in the session field of the sessions table in a serialized state that isn't decodable with PHP's default unserialize or session_decode functions. Browsing the net, it seemed a lot of people had struggled to decode it and we couldn't find any working solution.

So I decided to give a go at this myself. Here's the solution we found to work in all of our test cases. I can't guarantee it works 100% since I haven't seen documentation on how the serialization is done. If you have more information on this, don't hesitate to comment on this post.

function unserialize_session($val) {
  $result = array();

  // prefixing with semicolon to make it easier to write the regular expression
  $val = ';' . $val;

  // regularexpression to find the keys
  $keyreg = '/;([^|{}"]+)\|/';

  // find all keys
  $matches = array();
  preg_match_all($keyreg, $val, $matches);

  // only go further if we found some keys
  if (isset($matches[1])) {
    $keys = $matches[1];

    // find the values by splitting the input on the key regular expression
    $values = preg_split($keyreg, $val);

    // unshift the first value since it's always empty (due to our semicolon prefix)
    if (count($values) > 1) {
      array_shift($values);
    }

    // combine the $keys and $values
    $result = array_combine($keys, $values);
  }

  return $result;
}