unserialize

(PHP 4, PHP 5, PHP 7, PHP 8)

unserialize Creates a PHP value from a stored representation

Description

unserialize(string $data, array $options = []): mixed

unserialize() takes a single serialized variable and converts it back into a PHP value.

Warning

Do not pass untrusted user input to unserialize() regardless of the options value of allowed_classes. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.

If you need to unserialize externally-stored serialized data, consider using hash_hmac() for data validation. Make sure data is not modified by anyone but you.

Parameters

data

The serialized string.

If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists).

Note: unserialize_callback_func directive

It's possible to set a callback-function which will be called, if an undefined class should be instantiated during unserializing. (to prevent getting an incomplete object "__PHP_Incomplete_Class".) Use your php.ini, ini_set() or .htaccess to define unserialize_callback_func. Everytime an undefined class should be instantiated, it'll be called. To disable this feature just empty this setting.

options

Any options to be provided to unserialize(), as an associative array.

Valid options
Name Type Description
allowed_classes mixed Either an array of class names which should be accepted, false to accept no classes, or true to accept all classes. If this option is defined and unserialize() encounters an object of a class that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting this option is the same as defining it as true: PHP will attempt to instantiate objects of any class.

Return Values

The converted value is returned, and can be a bool, int, float, string, array or object.

In case the passed string is not unserializeable, false is returned and E_NOTICE is issued.

Errors/Exceptions

Objects may throw Throwables in their unserialization handlers.

Changelog

Version Description
7.1.0 The allowed_classes element of options) is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize() returns false and issues an E_WARNING.

Examples

Example #1 unserialize() example

<?php
// Here, we use unserialize() to load session data to the
// $session_data array from the string selected from a database.
// This example complements the one described with serialize().

$conn odbc_connect("webdb""php""chicken");
$stmt odbc_prepare($conn"SELECT data FROM sessions WHERE id = ?");
$sqldata = array($_SERVER['PHP_AUTH_USER']);
if (!
odbc_execute($stmt$sqldata) || !odbc_fetch_into($stmt$tmp)) {
    
// if the execute or fetch fails, initialize to empty array
    
$session_data = array();
} else {
    
// we should now have the serialized data in $tmp[0].
    
$session_data unserialize($tmp[0]);
    if (!
is_array($session_data)) {
        
// something went wrong, initialize to empty array
        
$session_data = array();
    }
}
?>

Example #2 unserialize_callback_func example

<?php
$serialized_object
='O:1:"a":1:5:"value";s:3:"100";';

ini_set('unserialize_callback_func''mycallback'); // set your callback_function

function mycallback($classname
{
    
// just include a file containing your class definition
    // you get $classname to figure out which class definition is required
}
?>

Notes

Warning

false is returned both in the case of an error and if unserializing the serialized false value. It is possible to catch this special case by comparing data with serialize(false) or by catching the issued E_NOTICE.

See Also

Here you can write a comment


Please enter at least 10 characters.
Loading... Please wait.
* Pflichtangabe
There are no comments available yet.

PHP cURL Tutorial: Using cURL to Make HTTP Requests

cURL is a powerful PHP extension that allows you to communicate with different servers using various protocols, including HTTP, HTTPS, FTP, and more. ...

TheMax

Autor : TheMax
Category: PHP-Tutorials

Midjourney Tutorial - Instructions for beginners

There is an informative video about Midjourney, the tool for creating digital images using artificial intelligence, entitled "Midjourney tutorial in German - instructions for beginners" ...

Mike94

Autor : Mike94
Category: KI Tutorials

Basics of views in MySQL

Views in a MySQL database offer the option of creating a virtual table based on the result of an SQL query. This virtual table can be queried like a normal table without changing the underlying data. ...

admin

Autor : admin
Category: mySQL-Tutorials

Publish a tutorial

Share your knowledge with other developers worldwide

Share your knowledge with other developers worldwide

You are a professional in your field and want to share your knowledge, then sign up now and share it with our PHP community

learn more

Publish a tutorial