__serialize and __unserialize in PHP - Step-by-Step Execution

Concept Flow - __serialize and __unserialize

Object created

↓

Call __serialize()

↓

Return array of properties

↓

Serialize array

↓

Store or transmit serialized data

↓

Call __unserialize(array)

↓

Restore object properties

↓

Object ready to use

When an object is serialized, PHP calls __serialize() to get data. When unserialized, __unserialize() restores the object from that data.

Execution Sample

PHP

<?php
class User {
  private string $name;
  private int $age;

  public function __construct(string $name, int $age) {
    $this->name = $name; $this->age = $age;
  }

  public function __serialize(): array {
    return ['name' => $this->name, 'age' => $this->age];
  }

  public function __unserialize(array $data): void {
    $this->name = $data['name'];
    $this->age = $data['age'];
  }
}

$user = new User("Anna", 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);

This code shows how __serialize and __unserialize convert an object to array and back during serialization.

Execution Table

Step	Action	Input	Output	Notes
1	Create User object	name='Anna', age=30	User object with properties set	Object initialized
2	Call serialize()	User object	Calls __serialize()	Returns ['name'=>'Anna', 'age'=>30]
3	serialize() converts array to string	['name'=>'Anna', 'age'=>30]	Serialized string	String format for storage/transmission
4	Call unserialize()	Serialized string	Calls __unserialize() with array	Array extracted from string
5	__unserialize() sets properties	['name'=>'Anna', 'age'=>30]	User object restored	Properties restored from array
6	Use unserialized object	User object	Access properties name='Anna', age=30	Object ready to use
7	End	N/A	N/A	Serialization cycle complete

💡 Serialization ends after __unserialize restores object properties

Variable Tracker

Variable	Start	After serialize	After unserialize	Final
$user	User(name='Anna', age=30)	User(name='Anna', age=30)	User(name='Anna', age=30)	User(name='Anna', age=30)
$serialized	N/A	Serialized string	Serialized string	Serialized string
$unserialized	N/A	N/A	User(name='Anna', age=30)	User(name='Anna', age=30)

Key Moments - 2 Insights

Why does PHP call __serialize() instead of directly serializing properties?

PHP calls __serialize() to let the object control which data to save, shown in step 2 of execution_table where __serialize returns a custom array.

What happens if __unserialize() does not restore all properties?

The object will be incomplete or broken after unserialization, as seen in step 5 where __unserialize sets properties; missing this step means missing data.

Visual Quiz - 3 Questions

Look at the execution_table, what does __serialize() return at step 2?

A The original object

B An array of object properties

C A serialized string

D Null

💡 Hint

See step 2 in execution_table where __serialize returns an array

At which step does __unserialize() restore the object properties?

A Step 3

B Step 4

C Step 5

D Step 6

💡 Hint

Step 5 in execution_table shows __unserialize setting properties

If __serialize() returned an empty array, what would happen after unserialize?

A Object properties would be empty or default

B Object would have original properties

C Serialization would fail

D Object would be null

💡 Hint

Refer to variable_tracker and key_moments about property restoration

Concept Snapshot

__serialize and __unserialize methods let PHP objects control serialization.
__serialize() returns an array of data to save.
__unserialize(array) restores object from that data.
Called automatically by serialize() and unserialize().
Use to customize what and how object data is saved.

Full Transcript

This visual trace shows how PHP uses __serialize and __unserialize methods during object serialization. First, an object is created with properties. When serialize() is called, PHP calls __serialize() to get an array of properties to save. This array is converted to a string for storage or transmission. Later, unserialize() converts the string back to an array and calls __unserialize() to restore the object's properties. The object is then ready to use with its original data. Key points include that __serialize controls what data is saved, and __unserialize must restore all needed properties to avoid broken objects.

Practice

1. What is the main purpose of the __serialize method in a PHP class?

easy

A. To specify which object properties should be saved during serialization

B. To automatically convert an object to a string

C. To rebuild an object from saved data

D. To delete object properties before saving

Solution

1. Step 1: Understand serialization

   Serialization means saving an object's data so it can be stored or sent.

2. Step 2: Role of __serialize

   The __serialize method tells PHP which properties to save when serializing.

3. Final Answer:

   To specify which object properties should be saved during serialization -> Option A

4. Quick Check:

   __serialize controls saved data = A [OK]

Hint: Remember: __serialize picks what to save [OK]

Common Mistakes:

• Confusing __serialize with __unserialize
• Thinking __serialize rebuilds objects
• Assuming it converts objects to strings automatically

2. Which of the following is the correct syntax for defining the __unserialize method in a PHP class?

easy

A. public function __unserialize($data)

B. function __unserialize(): array

C. private function __unserialize(array $data): string

D. public function __unserialize(array $data): void

Solution

1. Step 1: Check method signature

   The __unserialize method must accept an array parameter and return nothing (void).

2. Step 2: Match correct syntax

   public function __unserialize(array $data): void matches the correct signature: public function __unserialize(array $data): void.

3. Final Answer:

   public function __unserialize(array $data): void -> Option D

4. Quick Check:

   __unserialize signature = B [OK]

Hint: Look for array parameter and void return [OK]

Common Mistakes:

• Missing type hint for parameter
• Wrong return type specified
• Using private instead of public visibility

3. What will be the output of the following PHP code?

class User {
    private string $name;
    private int $age;

    public function __construct(string $name, int $age) {
        $this->name = $name;
        $this->age = $age;
    }

    public function __serialize(): array {
        return ['name' => $this->name];
    }

    public function __unserialize(array $data): void {
        $this->name = $data['name'];
        $this->age = 0;
    }

    public function getInfo(): string {
        return "Name: {$this->name}, Age: {$this->age}";
    }
}

$user = new User('Alice', 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);
echo $unserialized->getInfo();

medium

A. Name: Alice, Age: 30

B. Name: Alice, Age: 0

C. Name: , Age: 0

D. Error: Undefined index 'name'

Solution

1. Step 1: Analyze __serialize output

   The __serialize method returns only the 'name' property, so 'age' is not saved.

2. Step 2: Analyze __unserialize behavior

   When unserializing, 'name' is restored from data, but 'age' is set to 0 explicitly.

3. Final Answer:

   Name: Alice, Age: 0 -> Option B

4. Quick Check:

   Only 'name' saved, 'age' reset = C [OK]

Hint: Check what __serialize returns and how __unserialize sets properties [OK]

Common Mistakes:

• Assuming all properties are saved automatically
• Expecting original age to be restored
• Ignoring explicit age reset in __unserialize

4. Identify the error in this PHP class using __serialize and __unserialize:

class Product {
    private string $title;
    private float $price;

    public function __serialize(): array {
        return ['title' => $this->title, 'price' => $this->price];
    }

    public function __unserialize(array $data): void {
        $this->title = $data['title'];
        $this->price = $data['cost'];
    }
}

medium

A. Properties should be public for serialization

B. Missing return type in __serialize method

C. Using 'cost' key in __unserialize instead of 'price'

D. No constructor defined

Solution

1. Step 1: Compare keys in __serialize and __unserialize

   The __serialize method saves 'price' key, but __unserialize tries to read 'cost' key.

2. Step 2: Identify mismatch impact

   This mismatch causes an undefined index error when unserializing.

3. Final Answer:

   Using 'cost' key in __unserialize instead of 'price' -> Option C

4. Quick Check:

   Key mismatch in serialize/unserialize = A [OK]

Hint: Match keys exactly between __serialize and __unserialize [OK]

Common Mistakes:

• Using different keys for same property
• Ignoring array keys case sensitivity
• Assuming missing keys won't cause errors

5. You want to securely save only non-sensitive user data from an object and restore it later. Which approach using __serialize and __unserialize is best?

hard

A. In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults

B. Serialize all properties automatically and trust the storage security

C. Use __serialize to encrypt all data and __unserialize to decrypt

D. Do not implement __serialize or __unserialize and rely on default serialization

Solution

1. Step 1: Understand security needs

   Only non-sensitive data should be saved to avoid leaks.

2. Step 2: Use __serialize and __unserialize properly

   Return only safe properties in __serialize and restore them in __unserialize, setting sensitive data to safe defaults.

3. Final Answer:

   In __serialize, return only non-sensitive properties; in __unserialize, restore those and set sensitive ones to defaults -> Option A

4. Quick Check:

   Selective save and safe restore = D [OK]

Hint: Save only safe data, reset sensitive on restore [OK]

Common Mistakes:

• Saving all data without filtering
• Assuming encryption happens automatically
• Ignoring sensitive data in unserialize