A common use for unserialize is processing data without rebuilding the operation manually. Reconstructs PHP values from serialized data and can instantiate objects.
What Is unserialize in PHP?
Reconstructs PHP values from serialized data and can instantiate objects.
Syntax:
unserialize(?string $data, ?array $options = ...) : mixed
Parameters and Return Value
$data— A required string input for this operation. Verify the allowed values in the examples and context below.$options— An optional array input for this operation. Verify the allowed values in the examples and context below.
Declared return type: mixed. Distinguish false, an empty result, and exceptions where the API permits them.
Example 1: Basic Usage
This example demonstrates the main operation with a small, controlled input.
<?php
print_r(unserialize("a:2:{i:0;i:10;i:1;i:20;}", ["allowed_classes" => false]));
The example focuses on the value produced or the state changed by this API. Review the return value and validate input before using this pattern in production.
Example 2: Another Input
This example changes the input or surrounding setup to illustrate another behavior.
<?php
var_dump(unserialize("b:0;", ["allowed_classes" => false]));
The example focuses on the value produced or the state changed by this API. Review the return value and validate input before using this pattern in production.
Practical Example
This application-style example shows a self-contained usage pattern and checks its result.
<?php
$serializedArray = serialize(["theme" => "light"]);
$decodedArray = unserialize($serializedArray, ["allowed_classes" => false]);
print_r($decodedArray);
The example focuses on the value produced or the state changed by this API. Review the return value and validate input before using this pattern in production.
Important Behavior and Edge Cases
- Never unserialize untrusted data: disabling classes reduces some risks but is not a general input-safety guarantee.
- Use the intended input type and handle empty or malformed values explicitly.
- Where this API requires an extension, version, or file, document that dependency before using it in a real application.
Comparison With Related Functions
| Function or Method | When to Use It |
|---|---|
unserialize | Reconstructs PHP values from serialized data and can instantiate objects. |
json_decode | Parses a JSON string into objects or associative arrays and supports explicit error handling. |
Common Beginner Mistakes
| Mistake | Correct Approach |
|---|---|
| Using this API without checking the required input or extension | Never unserialize untrusted data: disabling classes reduces some risks but is not a general input-safety guarantee. |
| Deserializing arbitrary user-provided bytes | Prefer JSON for public data, and never instantiate untrusted serialized objects. |
| Confusing an object’s serialize() format with JSON | Use the matching class and serialization API when restoring trusted data. |
Key Takeaways
- Reconstructs PHP values from serialized data and can instantiate objects.
- Never unserialize untrusted data: disabling classes reduces some risks but is not a general input-safety guarantee.
- Test both the expected case and at least one failure or empty-input case before deployment.
Reconstructs PHP values from serialized data and can instantiate objects. Use it when the operation fits your input, output and validation requirements.