Creates a PHP value from a stored representation (original) (raw)

unserialize

(PHP 4, PHP 5, PHP 7)

unserialize — Creates a PHP value from a stored representation

Description

unserialize ( string $str [, array $options ] ) : mixed

unserialize() takes a single serialized variable and converts it back into a PHP value.

Warning

Do not pass untrusted user input to unserialize() regardless of the options value of allowed_classes. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (viajson_decode() and json_encode()) if you need to pass serialized data to the user.

If you need to unserialize externally-stored serialized data, consider usinghash_hmac() for data validation. Make sure data is not modified by anyone but you.

Parameters

str

The serialized string.

If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the__unserialize() or __wakeup() methods (if one exists).

Note: unserialize_callback_func directive

It's possible to set a callback-function which will be called, if an undefined class should be instantiated during unserializing. (to prevent getting an incomplete object "__PHP_Incomplete_Class".) Use your php.ini, ini_set() or .htaccess to define unserialize_callback_func. Everytime an undefined class should be instantiated, it'll be called. To disable this feature just empty this setting.

options

Any options to be provided to unserialize(), as an associative array.

Valid options

Name	Type	Description
allowed_classes	mixed	Either an array of class names which should be accepted, FALSE to accept no classes, or TRUE to accept all classes. If this option is defined andunserialize() encounters an object of a class that isn't to be accepted, then the object will be instantiated as__PHP_Incomplete_Class instead. Omitting this option is the same as defining it as TRUE: PHP will attempt to instantiate objects of any class.

Return Values

The converted value is returned, and can be a boolean,integer, float, string,array or object.

In case the passed string is not unserializeable, FALSE is returned and**E_NOTICE** is issued.

Changelog

Version	Description
7.1.0	The allowed_classes element ofoptions) is now strictly typed, i.e. if anything other than an array or a boolean is given,unserialize() returns FALSE and issues anE_WARNING.
7.0.0	The options parameter has been added.
5.6.0	Manipulating the serialised data by replacing C: with O: to force object instantiation without calling the constructor will now fail.

Examples

Example #1 unserialize() example

<?php // Here, we use unserialize() to load session data to the // $session_data array from the string selected from a database. // This example complements the one described with serialize().$conn = odbc_connect("webdb", "php", "chicken"); <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mi>s</mi><mi>t</mi><mi>m</mi><mi>t</mi><mo>=</mo><mi>o</mi><mi>d</mi><mi>b</mi><msub><mi>c</mi><mi>p</mi></msub><mi>r</mi><mi>e</mi><mi>p</mi><mi>a</mi><mi>r</mi><mi>e</mi><mo stretchy="false">(</mo></mrow><annotation encoding="application/x-tex">stmt = odbc_prepare(</annotation></semantics></math>stmt=odbcprepare(conn, "SELECT data FROM sessions WHERE id = ?"); <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mi>s</mi><mi>q</mi><mi>l</mi><mi>d</mi><mi>a</mi><mi>t</mi><mi>a</mi><mo>=</mo><mi>a</mi><mi>r</mi><mi>r</mi><mi>a</mi><mi>y</mi><mo stretchy="false">(</mo></mrow><annotation encoding="application/x-tex">sqldata = array(</annotation></semantics></math>sqldata=array(_SERVER['PHP_AUTH_USER']); if (!odbc_execute($stmt, <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mi>s</mi><mi>q</mi><mi>l</mi><mi>d</mi><mi>a</mi><mi>t</mi><mi>a</mi><mo stretchy="false">)</mo><mi mathvariant="normal">∣</mi><mi mathvariant="normal">∣</mi><mo stretchy="false">!</mo><mi>o</mi><mi>d</mi><mi>b</mi><msub><mi>c</mi><mi>f</mi></msub><mi>e</mi><mi>t</mi><mi>c</mi><msub><mi>h</mi><mi>i</mi></msub><mi>n</mi><mi>t</mi><mi>o</mi><mo stretchy="false">(</mo></mrow><annotation encoding="application/x-tex">sqldata) || !odbc_fetch_into(</annotation></semantics></math>sqldata)∣∣!odbcfetchinto(stmt, $tmp)) { // if the execute or fetch fails, initialize to empty array $session_data = array(); } else { // we should now have the serialized data in $tmp[0]. <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mi>s</mi><mi>e</mi><mi>s</mi><mi>s</mi><mi>i</mi><mi>o</mi><msub><mi>n</mi><mi>d</mi></msub><mi>a</mi><mi>t</mi><mi>a</mi><mo>=</mo><mi>u</mi><mi>n</mi><mi>s</mi><mi>e</mi><mi>r</mi><mi>i</mi><mi>a</mi><mi>l</mi><mi>i</mi><mi>z</mi><mi>e</mi><mo stretchy="false">(</mo></mrow><annotation encoding="application/x-tex">session_data = unserialize(</annotation></semantics></math>sessiondata=unserialize(tmp[0]); if (!is_array($session_data)) { // something went wrong, initialize to empty array $session_data = array(); } } ?>

Example #2 unserialize_callback_func example

<?php <math xmlns="http://www.w3.org/1998/Math/MathML"><semantics><mrow><mi>s</mi><mi>e</mi><mi>r</mi><mi>i</mi><mi>a</mi><mi>l</mi><mi>i</mi><mi>z</mi><mi>e</mi><msub><mi>d</mi><mi>o</mi></msub><mi>b</mi><mi>j</mi><mi>e</mi><mi>c</mi><mi>t</mi><msup><mo>=</mo><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><mi>O</mi><mo>:</mo><mn>1</mn><mo>:</mo><mi mathvariant="normal">"</mi><mi>a</mi><mi mathvariant="normal">"</mi><mo>:</mo><mn>1</mn><mo>:</mo><msup><mrow><mi>s</mi><mo>:</mo><mn>5</mn><mo>:</mo><mi mathvariant="normal">"</mi><mi>v</mi><mi>a</mi><mi>l</mi><mi>u</mi><mi>e</mi><mi mathvariant="normal">"</mi><mo separator="true">;</mo><mi>s</mi><mo>:</mo><mn>3</mn><mo>:</mo><mi mathvariant="normal">"</mi><mn>100</mn><mi mathvariant="normal">"</mi><mo separator="true">;</mo></mrow><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><mo separator="true">;</mo><mi>i</mi><mi>n</mi><msub><mi>i</mi><mi>s</mi></msub><mi>e</mi><mi>t</mi><msup><mo stretchy="false">(</mo><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><mi>u</mi><mi>n</mi><mi>s</mi><mi>e</mi><mi>r</mi><mi>i</mi><mi>a</mi><mi>l</mi><mi>i</mi><mi>z</mi><msub><mi>e</mi><mi>c</mi></msub><mi>a</mi><mi>l</mi><mi>l</mi><mi>b</mi><mi>a</mi><mi>c</mi><msub><mi>k</mi><mi>f</mi></msub><mi>u</mi><mi>n</mi><msup><mi>c</mi><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><msup><mo separator="true">,</mo><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><mi>m</mi><mi>y</mi><mi>c</mi><mi>a</mi><mi>l</mi><mi>l</mi><mi>b</mi><mi>a</mi><mi>c</mi><msup><mi>k</mi><mo mathvariant="normal" lspace="0em" rspace="0em">′</mo></msup><mo stretchy="false">)</mo><mo separator="true">;</mo><mi mathvariant="normal">/</mi><mi mathvariant="normal">/</mi><mi>s</mi><mi>e</mi><mi>t</mi><mi>y</mi><mi>o</mi><mi>u</mi><mi>r</mi><mi>c</mi><mi>a</mi><mi>l</mi><mi>l</mi><mi>b</mi><mi>a</mi><mi>c</mi><msub><mi>k</mi><mi>f</mi></msub><mi>u</mi><mi>n</mi><mi>c</mi><mi>t</mi><mi>i</mi><mi>o</mi><mi>n</mi><mi>f</mi><mi>u</mi><mi>n</mi><mi>c</mi><mi>t</mi><mi>i</mi><mi>o</mi><mi>n</mi><mi>m</mi><mi>y</mi><mi>c</mi><mi>a</mi><mi>l</mi><mi>l</mi><mi>b</mi><mi>a</mi><mi>c</mi><mi>k</mi><mo stretchy="false">(</mo></mrow><annotation encoding="application/x-tex">serialized_object='O:1:"a":1:{s:5:"value";s:3:"100";}';ini_set('unserialize_callback_func', 'mycallback'); // set your callback_functionfunction mycallback(</annotation></semantics></math>serializedobject=′O:1:"a":1:s:5:"value";s:3:"100";′;iniset(′unserializecallbackfunc′,′mycallback′);//setyourcallbackfunctionfunctionmycallback(classname) { // just include a file containing your class definition // you get $classname to figure out which class definition is required } ?>

Notes