__serialize and __unserialize in PHP - Deep Dive

Overview - __serialize and __unserialize

What is it?

__serialize and __unserialize are special methods in PHP that let you control how an object is turned into a string and back again. This process is called serialization and unserialization. When you save an object or send it somewhere, PHP uses these methods to decide what data to keep and how to restore it later. They give you full control over what parts of your object are saved and how.

Why it matters

Without __serialize and __unserialize, PHP uses a default way to save objects that might include sensitive or unnecessary data. This can cause security risks, bugs, or wasted space. By customizing these methods, you can protect your data, improve performance, and make sure your objects come back exactly as you want. Imagine sending a letter with only the important pages instead of the whole book—that's what these methods help you do.

Where it fits

Before learning __serialize and __unserialize, you should understand basic PHP classes and objects, and how serialization works in general. After this, you can explore related topics like __sleep and __wakeup (older serialization methods), and how to use serialization safely with external storage or APIs.

Mental Model

Core Idea

These methods let an object decide exactly how to pack itself into a string and unpack itself back into a full object.

Think of it like...

It's like packing a suitcase for a trip: __serialize is choosing what clothes and items to pack carefully, and __unserialize is unpacking and arranging them neatly when you arrive.

Object
  │
  ├─> __serialize() called → returns array of data to save
  │
  └─> Data saved as string

Later...

String data
  │
  ├─> __unserialize(array) called → restores object properties
  │
  └─> Object ready to use

Build-Up - 7 Steps

1

Foundation

What is Serialization in PHP

Concept: Serialization means turning an object into a string so it can be saved or sent somewhere.

In PHP, serialization converts an object into a string format. This string can be stored in a file, database, or sent over a network. Later, PHP can turn this string back into the original object using unserialization.

Result

You get a string that represents the object and can restore the object later.

Understanding serialization is key because __serialize and __unserialize customize this process.

2

Foundation

Default Serialization Behavior

Concept: PHP automatically saves all object properties when serializing unless told otherwise.

By default, PHP saves all public, protected, and private properties of an object when you serialize it. This can include sensitive or unnecessary data. The default unserialization restores all these properties automatically.

Result

All object data is saved and restored without control.

Knowing the default helps you see why custom methods are useful to control what gets saved.

3

Intermediate

Introducing __serialize Method

🤔Before reading on: do you think __serialize returns a string or an array? Commit to your answer.

Concept: __serialize lets you choose exactly what data to save by returning an array of properties.

The __serialize method is called when an object is serialized. It must return an array of key-value pairs representing the data you want to save. PHP then turns this array into a string. This lets you exclude or transform properties before saving.

Result

Only the data you return in the array is saved during serialization.

Understanding that __serialize returns an array gives you precise control over serialization.

4

Intermediate

Introducing __unserialize Method

🤔Before reading on: do you think __unserialize receives a string or an array? Commit to your answer.

Concept: __unserialize receives the saved data array and restores the object's properties from it.

When PHP unserializes an object, it calls __unserialize with the array returned by __serialize. You use this method to set the object's properties from the array. This lets you control how the object is rebuilt, including validation or default values.

Result

The object is restored exactly as you define in __unserialize.

Knowing __unserialize receives an array helps you safely rebuild the object from saved data.

5

Intermediate

Replacing __sleep and __wakeup

Concept: __serialize and __unserialize replace older methods __sleep and __wakeup with a clearer, safer approach.

Before PHP 7.4, __sleep and __wakeup were used to customize serialization. They had limitations and security risks. __serialize and __unserialize provide a modern, explicit way to handle serialization by working with arrays instead of strings, making code easier to understand and safer.

Result

Better control and security in object serialization.

Recognizing the improvements helps you write modern PHP code and avoid legacy pitfalls.

6

Advanced

Handling Sensitive Data Securely

🤔Before reading on: do you think sensitive data should be included in __serialize output? Commit to yes or no.

Concept: You can exclude or transform sensitive data in __serialize to protect it during serialization.

If your object has passwords or private keys, you should not save them directly. In __serialize, omit these or replace them with placeholders. In __unserialize, you can restore them safely or require re-authentication. This prevents leaking secrets when saving or sending objects.

Result

Serialized data is safer and does not expose sensitive information.

Knowing how to protect sensitive data prevents security leaks in real applications.

7

Expert

Custom Serialization for Performance

🤔Before reading on: do you think serializing all properties is always efficient? Commit to yes or no.

Concept: Custom __serialize can optimize performance by saving only essential data, reducing size and speed.

In large or complex objects, saving everything wastes space and time. By carefully selecting properties in __serialize, you reduce the serialized string size. This speeds up saving, loading, and network transfer. You can also transform data formats for faster unserialization.

Result

Faster and smaller serialization improves application performance.

Understanding performance tradeoffs helps build efficient, scalable PHP applications.

Under the Hood

When PHP serializes an object, it checks if __serialize exists. If yes, it calls __serialize to get an array of data. PHP then converts this array into a string format internally. When unserializing, PHP converts the string back to an array and calls __unserialize with it. This lets the object rebuild itself from the array. This process replaces the older __sleep and __wakeup methods and uses a clear array-based contract.

Why designed this way?

PHP introduced __serialize and __unserialize in version 7.4 to fix problems with __sleep and __wakeup, which were less explicit and more error-prone. Using arrays instead of strings makes the process safer and easier to control. It also aligns with PHP's move toward stronger typing and clearer APIs. This design reduces bugs and security risks while giving developers full control.

┌─────────────┐       calls       ┌───────────────┐
│   Object    │──────────────────▶│ __serialize() │
└─────────────┘                   └───────────────┘
       │                                │
       │ returns array                  │
       ▼                                ▼
┌─────────────┐                   ┌───────────────┐
│  Serializer │                   │   Array Data  │
└─────────────┘                   └───────────────┘
       │                                │
       │ converts to string             │
       ▼                                ▼
┌─────────────┐                   ┌───────────────┐
│ Serialized  │                   │  Storage or   │
│   String    │                   │ Transmission  │
└─────────────┘                   └───────────────┘

Later...

┌─────────────┐                   ┌───────────────┐
│ Serialized  │                   │   Array Data  │
│   String    │◀──────────────────│  Unserializer │
└─────────────┘                   └───────────────┘
       │                                │
       │ converts to array             │
       ▼                                ▼
┌─────────────┐       calls       ┌───────────────┐
│   Object    │◀──────────────────│ __unserialize()│
└─────────────┘                   └───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does __serialize return a string or an array? Commit to your answer.

Common Belief: Many think __serialize returns a string because serialization means a string.

Reality: __serialize actually returns an array of data, not a string. PHP converts this array to a string internally.

Why it matters: Thinking it returns a string leads to confusion and incorrect method implementations.

Quick: Does __unserialize receive a string or an array? Commit to your answer.

Common Belief: Some believe __unserialize receives a string to parse manually.

Reality: __unserialize receives an array already converted by PHP, so you just assign properties from it.

Why it matters: Misunderstanding this causes bugs where developers try to parse strings themselves.

Quick: Should all object properties always be serialized? Commit to yes or no.

Common Belief: Many assume all properties should be saved to keep the object complete.

Reality: Sensitive or temporary data should often be excluded to protect security and reduce size.

Why it matters: Including everything can leak secrets or cause performance issues.

Quick: Are __sleep and __wakeup still recommended for serialization? Commit to yes or no.

Common Belief: Some think __sleep and __wakeup are the best way to customize serialization.

Reality: They are legacy methods replaced by __serialize and __unserialize since PHP 7.4.

Why it matters: Using old methods can cause security risks and harder-to-maintain code.

Expert Zone

1

When multiple traits or parent classes define __serialize, the order of calls and merging arrays can cause subtle bugs.

2

Objects with circular references require careful handling in __serialize to avoid infinite loops or errors.

3

You can transform data formats in __serialize (e.g., encrypting or compressing) but must reverse in __unserialize, adding complexity.

When NOT to use

Avoid using __serialize and __unserialize if you need to serialize resources like database connections or file handles, as these cannot be serialized. Instead, use external storage or recreate such resources after unserialization. Also, for very simple objects without sensitive data, default serialization may be sufficient.

Production Patterns

In real-world PHP applications, __serialize and __unserialize are used to safely store user sessions, cache objects with only essential data, and securely transmit objects between services. Developers often combine these methods with encryption or validation to protect data integrity and privacy.

Connections

Data Serialization (General)

Builds-on

Understanding PHP's __serialize and __unserialize deepens your grasp of how data serialization works across many programming languages and systems.

Object-Oriented Programming (OOP)

Builds-on

Knowing how objects control their own serialization connects to core OOP ideas of encapsulation and data hiding.

Packing and Unpacking in Logistics

Analogy

The concept of carefully selecting what to pack and how to unpack in serialization mirrors real-world logistics challenges in shipping and storage.

Common Pitfalls

#1 Including sensitive data in serialization output.

Wrong approach:

public function __serialize(): array {
return [
'username' => $this->username,
'password' => $this->password // sensitive data included
];
}

Correct approach:

public function __serialize(): array {
return [
'username' => $this->username
// password excluded for security
];
}

Root cause:

Misunderstanding that all data must be saved leads to security risks.

#2 Trying to parse string data inside __unserialize manually.

Wrong approach:

public function __unserialize(string $data): void {
$array = unserialize($data); // wrong: PHP already passes array
$this->prop = $array['prop'];
}

Correct approach:

public function __unserialize(array $data): void {
$this->prop = $data['prop'];
}

Root cause:

Confusing the input type causes errors and redundant parsing.

#3 Not implementing __serialize and __unserialize when needed, relying on default serialization.

Wrong approach:

class User {
private $password;
// no __serialize or __unserialize
}

Correct approach:

class User {
private $password;
public function __serialize(): array {
return ['username' => $this->username];
}
public function __unserialize(array $data): void {
$this->username = $data['username'];
}
}

Root cause:

Ignoring custom serialization leads to security and correctness issues.

Key Takeaways

__serialize and __unserialize give objects full control over how they are saved and restored.

They replace older methods with a clearer, safer array-based approach introduced in PHP 7.4.

Customizing serialization helps protect sensitive data and improve performance.

Understanding the input and output types of these methods prevents common bugs.

Using these methods properly is essential for secure and efficient PHP applications.

Practice

1. What is the main purpose of the __serialize method in a PHP class?

easy

A. To specify which object properties should be saved during serialization

B. To automatically convert an object to a string

C. To rebuild an object from saved data

D. To delete object properties before saving

Solution

1. Step 1: Understand serialization

   Serialization means saving an object's data so it can be stored or sent.

2. Step 2: Role of __serialize

   The __serialize method tells PHP which properties to save when serializing.

3. Final Answer:

   To specify which object properties should be saved during serialization -> Option A

4. Quick Check:

   __serialize controls saved data = A [OK]

Hint: Remember: __serialize picks what to save [OK]

Common Mistakes:

• Confusing __serialize with __unserialize
• Thinking __serialize rebuilds objects
• Assuming it converts objects to strings automatically

2. Which of the following is the correct syntax for defining the __unserialize method in a PHP class?

easy

A. public function __unserialize($data)

B. function __unserialize(): array

C. private function __unserialize(array $data): string

D. public function __unserialize(array $data): void

Solution

1. Step 1: Check method signature

   The __unserialize method must accept an array parameter and return nothing (void).

2. Step 2: Match correct syntax

   public function __unserialize(array $data): void matches the correct signature: public function __unserialize(array $data): void.

3. Final Answer:

   public function __unserialize(array $data): void -> Option D

4. Quick Check:

   __unserialize signature = B [OK]

Hint: Look for array parameter and void return [OK]

Common Mistakes:

• Missing type hint for parameter
• Wrong return type specified
• Using private instead of public visibility

3. What will be the output of the following PHP code?

class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }

    public function __serialize(): array {
        return ['name' => $this->name];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->age = 0;
    }

    public function getInfo(): string {
        return "Name: {$this->name}, Age: {$this->age}";
    }
}

$user = new User('Alice', 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);
echo $unserialized->getInfo();

medium

A. Name: Alice, Age: 30

B. Name: Alice, Age: 0

C. Name: , Age: 0

D. Error: Undefined index 'name'

Solution

1. Step 1: Analyze __serialize output

   The __serialize method returns only the 'name' property, so 'age' is not saved.

2. Step 2: Analyze __unserialize behavior

   When unserializing, 'name' is restored from data, but 'age' is set to 0 explicitly.

3. Final Answer:

   Name: Alice, Age: 0 -> Option B

4. Quick Check:

   Only 'name' saved, 'age' reset = C [OK]

Hint: Check what __serialize returns and how __unserialize sets properties [OK]

Common Mistakes:

• Assuming all properties are saved automatically
• Expecting original age to be restored
• Ignoring explicit age reset in __unserialize

4. Identify the error in this PHP class using __serialize and __unserialize:

class Product {
    private string $title;
    private float $price;

    public function __serialize(): array {
        return ['title' => $this->title, 'price' => $this->price];
    }

    public function __unserialize(array $data): void {
        $this->title = $data['title'];
        $this->price = $data['cost'];
    }
}

medium

A. Properties should be public for serialization

B. Missing return type in __serialize method

C. Using 'cost' key in __unserialize instead of 'price'

D. No constructor defined

Solution

1. Step 1: Compare keys in __serialize and __unserialize

   The __serialize method saves 'price' key, but __unserialize tries to read 'cost' key.

2. Step 2: Identify mismatch impact

   This mismatch causes an undefined index error when unserializing.

3. Final Answer:

   Using 'cost' key in __unserialize instead of 'price' -> Option C

4. Quick Check:

   Key mismatch in serialize/unserialize = A [OK]

Hint: Match keys exactly between __serialize and __unserialize [OK]

Common Mistakes:

• Using different keys for same property
• Ignoring array keys case sensitivity
• Assuming missing keys won't cause errors

5. You want to securely save only non-sensitive user data from an object and restore it later. Which approach using __serialize and __unserialize is best?

hard

A. In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults

B. Serialize all properties automatically and trust the storage security

C. Use __serialize to encrypt all data and __unserialize to decrypt

D. Do not implement __serialize or __unserialize and rely on default serialization

Solution

1. Step 1: Understand security needs

   Only non-sensitive data should be saved to avoid leaks.

2. Step 2: Use __serialize and __unserialize properly

   Return only safe properties in __serialize and restore them in __unserialize, setting sensitive data to safe defaults.

3. Final Answer:

   In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults -> Option A

4. Quick Check:

   Selective save and safe restore = D [OK]

Hint: Save only safe data, reset sensitive on restore [OK]

Common Mistakes:

• Saving all data without filtering
• Assuming encryption happens automatically
• Ignoring sensitive data in unserialize