PHP Serialization
Serialization is the process of converting a storable representation of a value. This is useful for storing or passing PHP values around without losing their type and structure.
1. serialize()
Generates a storable representation of a value. It handles arrays, objects, and scalar types (except resources).
$data = ['apple', 'banana', 'orange'];
$serialized = serialize($data);
echo $serialized;
// Outputs: a:3:{i:0;s:5:"apple";i:1;s:6:"banana";i:2;s:6:"orange";}2. unserialize()
Takes a single serialized variable and converts it back into a PHP value.
$original = unserialize($serialized);
print_r($original);
// Outputs the original array3. Security Warning (Object Injection)
Do not pass untrusted user input to unserialize().
If an attacker can control the string passed to unserialize(), they can force the instantiation of arbitrary objects in your application. If these classes define destructors or magic methods like __wakeup, they can trigger malicious code execution.
Alternative: Use json_encode() and json_decode() for safer data interchange.
4. Magic Methods
Objects can customize their serialization process using magic methods.
__sleep(): Called before serialization. It is supposed to return an array with the names of all variables of that object that should be serialized.__wakeup(): Called after unserialization. It can reconstruct any resources that the object may have.
class Connection {
public function __sleep() {
// Close DB connection, return array of properties to save
return ['dsn', 'username', 'password'];
}
public function __wakeup() {
// Reconnect to DB
}
}programming/php/php programming/php/php-magic-methods programming/php/php-json