__serialize and __unserialize in PHP - Mini Project: Build & Apply

Using __serialize and __unserialize in PHP

📖 Scenario: Imagine you have a simple PHP class representing a book in a library system. You want to save and restore the book's data easily using PHP's serialization features.

🎯 Goal: You will create a PHP class with __serialize and __unserialize methods to control how the book's data is saved and restored.

📋 What You'll Learn

Create a class called Book with properties title and author

Add a __serialize method that returns an array with the book's data

Add a __unserialize method that restores the book's data from an array

Create an instance of Book with specific title and author

Serialize and then unserialize the book object

Print the restored book's title and author

💡 Why This Matters

🌍 Real World

Serialization is used to save objects to files or databases and restore them later, such as saving user sessions or caching data.

💼 Career

Understanding how to customize serialization helps developers control data storage and transfer, which is important in backend development and data management.

1

Create the Book class with properties

Create a class called Book with public properties title and author. Then create an instance called $book with title set to '1984' and author set to 'George Orwell'.

PHP

<?php

// Create the Book class with public properties title and author
// Create an instance $book with title '1984' and author 'George Orwell'

// Your code here

Hint

Define the class with two public properties. Then create an object and assign the values.

2

Add the __serialize method

Add a public method __serialize to the Book class that returns an array with keys 'title' and 'author' and their corresponding property values.

PHP

title = '1984';
$book->author = 'George Orwell';

// Your code here

Hint

The __serialize method should return an array with the object's data.

3

Add the __unserialize method

Add a public method __unserialize to the Book class that accepts an array parameter $data and sets the title and author properties from the array keys 'title' and 'author'.

PHP

 $this->title,
            'author' => $this->author
        ];
    }

    // Add __unserialize method here

}

$book = new Book();
$book->title = '1984';
$book->author = 'George Orwell';

// Your code here

Hint

The __unserialize method receives an array and sets the object's properties from it.

4

Serialize and unserialize the Book object and print

Serialize the $book object into $serialized. Then unserialize it back into $restoredBook. Finally, print the restored book's title and author using echo in the format: Title: 1984, Author: George Orwell.

PHP

 $this->title,
            'author' => $this->author
        ];
    }

    public function __unserialize(array $data): void {
        $this->title = $data['title'];
        $this->author = $data['author'];
    }
}

$book = new Book();
$book->title = '1984';
$book->author = 'George Orwell';

// Serialize $book into $serialized
// Unserialize $serialized into $restoredBook
// Print the restored book's title and author

// Your code here

Hint

Use serialize() and unserialize() functions. Then print the restored object's properties.

Practice

1. What is the main purpose of the __serialize method in a PHP class?

easy

A. To specify which object properties should be saved during serialization

B. To automatically convert an object to a string

C. To rebuild an object from saved data

D. To delete object properties before saving

Solution

1. Step 1: Understand serialization

   Serialization means saving an object's data so it can be stored or sent.

2. Step 2: Role of __serialize

   The __serialize method tells PHP which properties to save when serializing.

3. Final Answer:

   To specify which object properties should be saved during serialization -> Option A

4. Quick Check:

   __serialize controls saved data = A [OK]

Hint: Remember: __serialize picks what to save [OK]

Common Mistakes:

• Confusing __serialize with __unserialize
• Thinking __serialize rebuilds objects
• Assuming it converts objects to strings automatically

2. Which of the following is the correct syntax for defining the __unserialize method in a PHP class?

easy

A. public function __unserialize($data)

B. function __unserialize(): array

C. private function __unserialize(array $data): string

D. public function __unserialize(array $data): void

Solution

1. Step 1: Check method signature

   The __unserialize method must accept an array parameter and return nothing (void).

2. Step 2: Match correct syntax

   public function __unserialize(array $data): void matches the correct signature: public function __unserialize(array $data): void.

3. Final Answer:

   public function __unserialize(array $data): void -> Option D

4. Quick Check:

   __unserialize signature = B [OK]

Hint: Look for array parameter and void return [OK]

Common Mistakes:

• Missing type hint for parameter
• Wrong return type specified
• Using private instead of public visibility

3. What will be the output of the following PHP code?

class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }

    public function __serialize(): array {
        return ['name' => $this->name];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->age = 0;
    }

    public function getInfo(): string {
        return "Name: {$this->name}, Age: {$this->age}";
    }
}

$user = new User('Alice', 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);
echo $unserialized->getInfo();

medium

A. Name: Alice, Age: 30

B. Name: Alice, Age: 0

C. Name: , Age: 0

D. Error: Undefined index 'name'

Solution

1. Step 1: Analyze __serialize output

   The __serialize method returns only the 'name' property, so 'age' is not saved.

2. Step 2: Analyze __unserialize behavior

   When unserializing, 'name' is restored from data, but 'age' is set to 0 explicitly.

3. Final Answer:

   Name: Alice, Age: 0 -> Option B

4. Quick Check:

   Only 'name' saved, 'age' reset = C [OK]

Hint: Check what __serialize returns and how __unserialize sets properties [OK]

Common Mistakes:

• Assuming all properties are saved automatically
• Expecting original age to be restored
• Ignoring explicit age reset in __unserialize

4. Identify the error in this PHP class using __serialize and __unserialize:

class Product {
    private string $title;
    private float $price;

    public function __serialize(): array {
        return ['title' => $this->title, 'price' => $this->price];
    }

    public function __unserialize(array $data): void {
        $this->title = $data['title'];
        $this->price = $data['cost'];
    }
}

medium

A. Properties should be public for serialization

B. Missing return type in __serialize method

C. Using 'cost' key in __unserialize instead of 'price'

D. No constructor defined

Solution

1. Step 1: Compare keys in __serialize and __unserialize

   The __serialize method saves 'price' key, but __unserialize tries to read 'cost' key.

2. Step 2: Identify mismatch impact

   This mismatch causes an undefined index error when unserializing.

3. Final Answer:

   Using 'cost' key in __unserialize instead of 'price' -> Option C

4. Quick Check:

   Key mismatch in serialize/unserialize = A [OK]

Hint: Match keys exactly between __serialize and __unserialize [OK]

Common Mistakes:

• Using different keys for same property
• Ignoring array keys case sensitivity
• Assuming missing keys won't cause errors

5. You want to securely save only non-sensitive user data from an object and restore it later. Which approach using __serialize and __unserialize is best?

hard

A. In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults

B. Serialize all properties automatically and trust the storage security

C. Use __serialize to encrypt all data and __unserialize to decrypt

D. Do not implement __serialize or __unserialize and rely on default serialization

Solution

1. Step 1: Understand security needs

   Only non-sensitive data should be saved to avoid leaks.

2. Step 2: Use __serialize and __unserialize properly

   Return only safe properties in __serialize and restore them in __unserialize, setting sensitive data to safe defaults.

3. Final Answer:

   In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults -> Option A

4. Quick Check:

   Selective save and safe restore = D [OK]

Hint: Save only safe data, reset sensitive on restore [OK]

Common Mistakes:

• Saving all data without filtering
• Assuming encryption happens automatically
• Ignoring sensitive data in unserialize