Avoiding Unsafe Deserialization in PHP

PHP unserialize() can instantiate classes and trigger object methods; this makes untrusted serialized input dangerous.

What It Does

PHP unserialize() can instantiate classes and trigger object methods; this makes untrusted serialized input dangerous. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Understand the primary operation and its inputs.

<?php
$payload = '{"id":8,"active":true}';
$data = json_decode($payload, true, 32, JSON_THROW_ON_ERROR);
if (!is_int($data['id'] ?? null)) throw new UnexpectedValueException('Invalid ID');
echo $data['id'];

Example 2: Another Case

Check failure behavior or a different execution path.

<?php
$malicious = 'O:8:"stdClass":0:{}';
$result = @unserialize($malicious, ['allowed_classes' => false]);
var_dump($result instanceof __PHP_Incomplete_Class); // Still avoid untrusted PHP serialization

Practical Example: Putting It to Use

Apply the behavior in a small, controlled scenario.

<?php
function safeRecord(array $payload): array { return ['id' => filter_var($payload['id'] ?? null, FILTER_VALIDATE_INT), 'name' => (string) ($payload['name'] ?? '')]; }
print_r(safeRecord(['id' => '5', 'name' => 'Kai', 'admin' => true]));

Important Behavior and Edge Cases

Never treat allowed_classes=false as a reason to accept attacker-controlled serialized payloads.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• PHP unserialize() can instantiate classes and trigger object methods; this makes untrusted serialized input dangerous.
• Never treat allowed_classes=false as a reason to accept attacker-controlled serialized payloads.
• Prefer JSON with schema validation for data exchange.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.