__serialize and __unserialize in PHP - Deep Dive

Overview - __serialize and __unserialize

What is it?

__serialize and __unserialize are special methods in PHP that let you control how an object is turned into a string and back again. This process is called serialization and unserialization. When you save an object or send it somewhere, PHP uses these methods to decide what data to keep and how to restore it later. They give you full control over what parts of your object are saved and how.

Why it matters

Without __serialize and __unserialize, PHP uses a default way to save objects that might include sensitive or unnecessary data. This can cause security risks, bugs, or wasted space. By customizing these methods, you can protect your data, improve performance, and make sure your objects come back exactly as you want. Imagine sending a letter with only the important pages instead of the whole book—that's what these methods help you do.

Where it fits

Before learning __serialize and __unserialize, you should understand basic PHP classes and objects, and how serialization works in general. After this, you can explore related topics like __sleep and __wakeup (older serialization methods), and how to use serialization safely with external storage or APIs.

Mental Model

Core Idea

These methods let an object decide exactly how to pack itself into a string and unpack itself back into a full object.

Think of it like...

It's like packing a suitcase for a trip: __serialize is choosing what clothes and items to pack carefully, and __unserialize is unpacking and arranging them neatly when you arrive.

Object
  │
  ├─> __serialize() called → returns array of data to save
  │
  └─> Data saved as string

Later...

String data
  │
  ├─> __unserialize(array) called → restores object properties
  │
  └─> Object ready to use

Build-Up - 7 Steps

1

Foundation

What is Serialization in PHP

Concept: Serialization means turning an object into a string so it can be saved or sent somewhere.

In PHP, serialization converts an object into a string format. This string can be stored in a file, database, or sent over a network. Later, PHP can turn this string back into the original object using unserialization.

Result

You get a string that represents the object and can restore the object later.

Understanding serialization is key because __serialize and __unserialize customize this process.

2

Foundation

Default Serialization Behavior

Concept: PHP automatically saves all object properties when serializing unless told otherwise.

By default, PHP saves all public, protected, and private properties of an object when you serialize it. This can include sensitive or unnecessary data. The default unserialization restores all these properties automatically.

Result

All object data is saved and restored without control.

Knowing the default helps you see why custom methods are useful to control what gets saved.

3

Intermediate

Introducing __serialize Method

🤔Before reading on: do you think __serialize returns a string or an array? Commit to your answer.

Concept: __serialize lets you choose exactly what data to save by returning an array of properties.

The __serialize method is called when an object is serialized. It must return an array of key-value pairs representing the data you want to save. PHP then turns this array into a string. This lets you exclude or transform properties before saving.

Result

Only the data you return in the array is saved during serialization.

Understanding that __serialize returns an array gives you precise control over serialization.

4

Intermediate

Introducing __unserialize Method

🤔Before reading on: do you think __unserialize receives a string or an array? Commit to your answer.

Concept: __unserialize receives the saved data array and restores the object's properties from it.

When PHP unserializes an object, it calls __unserialize with the array returned by __serialize. You use this method to set the object's properties from the array. This lets you control how the object is rebuilt, including validation or default values.

Result

The object is restored exactly as you define in __unserialize.

Knowing __unserialize receives an array helps you safely rebuild the object from saved data.

5

Intermediate

Replacing __sleep and __wakeup

Concept: __serialize and __unserialize replace older methods __sleep and __wakeup with a clearer, safer approach.

Before PHP 7.4, __sleep and __wakeup were used to customize serialization. They had limitations and security risks. __serialize and __unserialize provide a modern, explicit way to handle serialization by working with arrays instead of strings, making code easier to understand and safer.

Result

Better control and security in object serialization.

Recognizing the improvements helps you write modern PHP code and avoid legacy pitfalls.

6

Advanced

Handling Sensitive Data Securely

🤔Before reading on: do you think sensitive data should be included in __serialize output? Commit to yes or no.

Concept: You can exclude or transform sensitive data in __serialize to protect it during serialization.

If your object has passwords or private keys, you should not save them directly. In __serialize, omit these or replace them with placeholders. In __unserialize, you can restore them safely or require re-authentication. This prevents leaking secrets when saving or sending objects.

Result

Serialized data is safer and does not expose sensitive information.

Knowing how to protect sensitive data prevents security leaks in real applications.

7

Expert

Custom Serialization for Performance

🤔Before reading on: do you think serializing all properties is always efficient? Commit to yes or no.

Concept: Custom __serialize can optimize performance by saving only essential data, reducing size and speed.

In large or complex objects, saving everything wastes space and time. By carefully selecting properties in __serialize, you reduce the serialized string size. This speeds up saving, loading, and network transfer. You can also transform data formats for faster unserialization.

Result

Faster and smaller serialization improves application performance.

Understanding performance tradeoffs helps build efficient, scalable PHP applications.

Under the Hood

When PHP serializes an object, it checks if __serialize exists. If yes, it calls __serialize to get an array of data. PHP then converts this array into a string format internally. When unserializing, PHP converts the string back to an array and calls __unserialize with it. This lets the object rebuild itself from the array. This process replaces the older __sleep and __wakeup methods and uses a clear array-based contract.

Why designed this way?

PHP introduced __serialize and __unserialize in version 7.4 to fix problems with __sleep and __wakeup, which were less explicit and more error-prone. Using arrays instead of strings makes the process safer and easier to control. It also aligns with PHP's move toward stronger typing and clearer APIs. This design reduces bugs and security risks while giving developers full control.

┌─────────────┐       calls       ┌───────────────┐
│   Object    │──────────────────▶│ __serialize() │
└─────────────┘                   └───────────────┘
       │                                │
       │ returns array                  │
       ▼                                ▼
┌─────────────┐                   ┌───────────────┐
│  Serializer │                   │   Array Data  │
└─────────────┘                   └───────────────┘
       │                                │
       │ converts to string             │
       ▼                                ▼
┌─────────────┐                   ┌───────────────┐
│ Serialized  │                   │  Storage or   │
│   String    │                   │ Transmission  │
└─────────────┘                   └───────────────┘

Later...

┌─────────────┐                   ┌───────────────┐
│ Serialized  │                   │   Array Data  │
│   String    │◀──────────────────│  Unserializer │
└─────────────┘                   └───────────────┘
       │                                │
       │ converts to array             │
       ▼                                ▼
┌─────────────┐       calls       ┌───────────────┐
│   Object    │◀──────────────────│ __unserialize()│
└─────────────┘                   └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does __serialize return a string or an array? Commit to your answer.

Common Belief: Many think __serialize returns a string because serialization means a string.

Reality: __serialize actually returns an array of data, not a string. PHP converts this array to a string internally.

Why it matters: Thinking it returns a string leads to confusion and incorrect method implementations.

Quick: Does __unserialize receive a string or an array? Commit to your answer.

Common Belief: Some believe __unserialize receives a string to parse manually.

Reality: __unserialize receives an array already converted by PHP, so you just assign properties from it.

Why it matters: Misunderstanding this causes bugs where developers try to parse strings themselves.

Quick: Should all object properties always be serialized? Commit to yes or no.

Common Belief: Many assume all properties should be saved to keep the object complete.

Reality: Sensitive or temporary data should often be excluded to protect security and reduce size.

Why it matters: Including everything can leak secrets or cause performance issues.

Quick: Are __sleep and __wakeup still recommended for serialization? Commit to yes or no.

Common Belief: Some think __sleep and __wakeup are the best way to customize serialization.

Reality: They are legacy methods replaced by __serialize and __unserialize since PHP 7.4.

Why it matters: Using old methods can cause security risks and harder-to-maintain code.

Expert Zone

1

When multiple traits or parent classes define __serialize, the order of calls and merging arrays can cause subtle bugs.

2

Objects with circular references require careful handling in __serialize to avoid infinite loops or errors.

3

You can transform data formats in __serialize (e.g., encrypting or compressing) but must reverse in __unserialize, adding complexity.

When NOT to use

Avoid using __serialize and __unserialize if you need to serialize resources like database connections or file handles, as these cannot be serialized. Instead, use external storage or recreate such resources after unserialization. Also, for very simple objects without sensitive data, default serialization may be sufficient.

Production Patterns

In real-world PHP applications, __serialize and __unserialize are used to safely store user sessions, cache objects with only essential data, and securely transmit objects between services. Developers often combine these methods with encryption or validation to protect data integrity and privacy.

Connections

Data Serialization (General)

Builds-on

Understanding PHP's __serialize and __unserialize deepens your grasp of how data serialization works across many programming languages and systems.

Object-Oriented Programming (OOP)

Builds-on

Knowing how objects control their own serialization connects to core OOP ideas of encapsulation and data hiding.

Packing and Unpacking in Logistics

Analogy

The concept of carefully selecting what to pack and how to unpack in serialization mirrors real-world logistics challenges in shipping and storage.

Common Pitfalls

#1 Including sensitive data in serialization output.

Wrong approach:

public function __serialize(): array {
return [
'username' => $this->username,
'password' => $this->password // sensitive data included
];
}

Correct approach:

public function __serialize(): array {
return [
'username' => $this->username
// password excluded for security
];
}

Root cause:

Misunderstanding that all data must be saved leads to security risks.

#2 Trying to parse string data inside __unserialize manually.

Wrong approach:

public function __unserialize(string $data): void {
$array = unserialize($data); // wrong: PHP already passes array
$this->prop = $array['prop'];
}

Correct approach:

public function __unserialize(array $data): void {
$this->prop = $data['prop'];
}

Root cause:

Confusing the input type causes errors and redundant parsing.

#3 Not implementing __serialize and __unserialize when needed, relying on default serialization.

Wrong approach:

class User {
private $password;
// no __serialize or __unserialize
}

Correct approach:

class User {
private $password;
public function __serialize(): array {
return ['username' => $this->username];
}
public function __unserialize(array $data): void {
$this->username = $data['username'];
}
}

Root cause:

Ignoring custom serialization leads to security and correctness issues.

Key Takeaways

__serialize and __unserialize give objects full control over how they are saved and restored.

They replace older methods with a clearer, safer array-based approach introduced in PHP 7.4.

Customizing serialization helps protect sensitive data and improve performance.

Understanding the input and output types of these methods prevents common bugs.

Using these methods properly is essential for secure and efficient PHP applications.