__serialize and __unserialize in PHP

Introduction

These methods help you control how an object is saved and restored. They let you decide what data to keep when saving an object and how to rebuild it later.

When you want to save an object to a file or send it over the internet.

When you need to customize which parts of an object are saved.

When restoring an object and you want to set up extra things after loading.

When you want to avoid saving sensitive or unnecessary data.

When you want to improve performance by saving only important data.

Syntax

PHP

class ClassName {
    public function __serialize(): array {
        // return array of data to save
    }

    public function __unserialize(array $data): void {
        // restore object from $data
    }
}

The __serialize method returns an array of data to save.

The __unserialize method receives that array to rebuild the object.

Examples

This example saves and restores the name and age properties.

PHP

class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }

    public function __serialize(): array {
        return ['name' => $this->name, 'age' => $this->age];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->age = $data['age'];
    }
}

This example saves only the token and resets secret when restoring.

PHP

class Session {
    private string $token;
    private string $secret;

    public function __serialize(): array {
        // Only save token, not secret
        return ['token' => $this->token];
    }

    public function __unserialize(array $data): void {
        $this->token = $data['token'];
        $this->secret = 'default'; // reset secret
    }
}

Sample Program

This program creates a Product object, saves it as a string, then restores it back to an object and shows its data.

PHP

<?php
class Product {
    private string $name;
    private float $price;

    public function __construct(string $name, float $price) {
        $this->name = $name;
        $this->price = $price;
    }

    public function __serialize(): array {
        return ['name' => $this->name, 'price' => $this->price];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->price = $data['price'];
    }

    public function display(): void {
        echo "Product: {$this->name}, Price: \${$this->price}\n";
    }
}

$product = new Product('Book', 12.99);

// Serialize the object
$serialized = serialize($product);
echo "Serialized: $serialized\n";

// Unserialize to new object
$newProduct = unserialize($serialized);
$newProduct->display();

Important Notes

These methods replace older __sleep and __wakeup methods for serialization.

Always return an array from __serialize and accept an array in __unserialize.

Use these methods to avoid saving sensitive data like passwords.

Summary

__serialize controls what data is saved from an object.

__unserialize rebuilds the object from saved data.

They help you save and restore objects safely and efficiently.

Practice

1. What is the main purpose of the __serialize method in a PHP class?

easy

A. To specify which object properties should be saved during serialization

B. To automatically convert an object to a string

C. To rebuild an object from saved data

D. To delete object properties before saving

Solution

1. Step 1: Understand serialization

   Serialization means saving an object's data so it can be stored or sent.

2. Step 2: Role of __serialize

   The __serialize method tells PHP which properties to save when serializing.

3. Final Answer:

   To specify which object properties should be saved during serialization -> Option A

4. Quick Check:

   __serialize controls saved data = A [OK]

Hint: Remember: __serialize picks what to save [OK]

Common Mistakes:

• Confusing __serialize with __unserialize
• Thinking __serialize rebuilds objects
• Assuming it converts objects to strings automatically

2. Which of the following is the correct syntax for defining the __unserialize method in a PHP class?

easy

A. public function __unserialize($data)

B. function __unserialize(): array

C. private function __unserialize(array $data): string

D. public function __unserialize(array $data): void

Solution

1. Step 1: Check method signature

   The __unserialize method must accept an array parameter and return nothing (void).

2. Step 2: Match correct syntax

   public function __unserialize(array $data): void matches the correct signature: public function __unserialize(array $data): void.

3. Final Answer:

   public function __unserialize(array $data): void -> Option D

4. Quick Check:

   __unserialize signature = B [OK]

Hint: Look for array parameter and void return [OK]

Common Mistakes:

• Missing type hint for parameter
• Wrong return type specified
• Using private instead of public visibility

3. What will be the output of the following PHP code?

class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }

    public function __serialize(): array {
        return ['name' => $this->name];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->age = 0;
    }

    public function getInfo(): string {
        return "Name: {$this->name}, Age: {$this->age}";
    }
}

$user = new User('Alice', 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);
echo $unserialized->getInfo();

medium

A. Name: Alice, Age: 30

B. Name: Alice, Age: 0

C. Name: , Age: 0

D. Error: Undefined index 'name'

Solution

1. Step 1: Analyze __serialize output

   The __serialize method returns only the 'name' property, so 'age' is not saved.

2. Step 2: Analyze __unserialize behavior

   When unserializing, 'name' is restored from data, but 'age' is set to 0 explicitly.

3. Final Answer:

   Name: Alice, Age: 0 -> Option B

4. Quick Check:

   Only 'name' saved, 'age' reset = C [OK]

Hint: Check what __serialize returns and how __unserialize sets properties [OK]

Common Mistakes:

• Assuming all properties are saved automatically
• Expecting original age to be restored
• Ignoring explicit age reset in __unserialize

4. Identify the error in this PHP class using __serialize and __unserialize:

class Product {
    private string $title;
    private float $price;

    public function __serialize(): array {
        return ['title' => $this->title, 'price' => $this->price];
    }

    public function __unserialize(array $data): void {
        $this->title = $data['title'];
        $this->price = $data['cost'];
    }
}

medium

A. Properties should be public for serialization

B. Missing return type in __serialize method

C. Using 'cost' key in __unserialize instead of 'price'

D. No constructor defined

Solution

1. Step 1: Compare keys in __serialize and __unserialize

   The __serialize method saves 'price' key, but __unserialize tries to read 'cost' key.

2. Step 2: Identify mismatch impact

   This mismatch causes an undefined index error when unserializing.

3. Final Answer:

   Using 'cost' key in __unserialize instead of 'price' -> Option C

4. Quick Check:

   Key mismatch in serialize/unserialize = A [OK]

Hint: Match keys exactly between __serialize and __unserialize [OK]

Common Mistakes:

• Using different keys for same property
• Ignoring array keys case sensitivity
• Assuming missing keys won't cause errors

5. You want to securely save only non-sensitive user data from an object and restore it later. Which approach using __serialize and __unserialize is best?

hard

A. In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults

B. Serialize all properties automatically and trust the storage security

C. Use __serialize to encrypt all data and __unserialize to decrypt

D. Do not implement __serialize or __unserialize and rely on default serialization

Solution

1. Step 1: Understand security needs

   Only non-sensitive data should be saved to avoid leaks.

2. Step 2: Use __serialize and __unserialize properly

   Return only safe properties in __serialize and restore them in __unserialize, setting sensitive data to safe defaults.

3. Final Answer:

   In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults -> Option A

4. Quick Check:

   Selective save and safe restore = D [OK]

Hint: Save only safe data, reset sensitive on restore [OK]

Common Mistakes:

• Saving all data without filtering
• Assuming encryption happens automatically
• Ignoring sensitive data in unserialize