__serialize and __unserialize in PHP - Step-by-Step Execution

Concept Flow - __serialize and __unserialize

Object created

↓

Call __serialize()

↓

Return array of properties

↓

Serialize array

↓

Store or transmit serialized data

↓

Call __unserialize(array)

↓

Restore object properties

↓

Object ready to use

When an object is serialized, PHP calls __serialize() to get data. When unserialized, __unserialize() restores the object from that data.

Execution Sample

PHP

<?php
class User {
  private string $name;
  private int $age;

  public function __construct(string $name, int $age) {
    $this->name = $name; $this->age = $age;
  }

  public function __serialize(): array {
    return ['name' => $this->name, 'age' => $this->age];
  }

  public function __unserialize(array $data): void {
    $this->name = $data['name'];
    $this->age = $data['age'];
  }
}

$user = new User("Anna", 30);
$serialized = serialize($user);
$unserialized = unserialize($serialized);

This code shows how __serialize and __unserialize convert an object to array and back during serialization.

Execution Table

Step	Action	Input	Output	Notes
1	Create User object	name='Anna', age=30	User object with properties set	Object initialized
2	Call serialize()	User object	Calls __serialize()	Returns ['name'=>'Anna', 'age'=>30]
3	serialize() converts array to string	['name'=>'Anna', 'age'=>30]	Serialized string	String format for storage/transmission
4	Call unserialize()	Serialized string	Calls __unserialize() with array	Array extracted from string
5	__unserialize() sets properties	['name'=>'Anna', 'age'=>30]	User object restored	Properties restored from array
6	Use unserialized object	User object	Access properties name='Anna', age=30	Object ready to use
7	End	N/A	N/A	Serialization cycle complete

💡 Serialization ends after __unserialize restores object properties

Variable Tracker

Variable	Start	After serialize	After unserialize	Final
$user	User(name='Anna', age=30)	User(name='Anna', age=30)	User(name='Anna', age=30)	User(name='Anna', age=30)
$serialized	N/A	Serialized string	Serialized string	Serialized string
$unserialized	N/A	N/A	User(name='Anna', age=30)	User(name='Anna', age=30)

Key Moments - 2 Insights

Why does PHP call __serialize() instead of directly serializing properties?

PHP calls __serialize() to let the object control which data to save, shown in step 2 of execution_table where __serialize returns a custom array.

What happens if __unserialize() does not restore all properties?

The object will be incomplete or broken after unserialization, as seen in step 5 where __unserialize sets properties; missing this step means missing data.

Visual Quiz - 3 Questions

Look at the execution_table, what does __serialize() return at step 2?

A The original object

B An array of object properties

C A serialized string

D Null

💡 Hint

See step 2 in execution_table where __serialize returns an array

At which step does __unserialize() restore the object properties?

A Step 3

B Step 4

C Step 5

D Step 6

💡 Hint

Step 5 in execution_table shows __unserialize setting properties

If __serialize() returned an empty array, what would happen after unserialize?

A Object properties would be empty or default

B Object would have original properties

C Serialization would fail

D Object would be null

💡 Hint

Refer to variable_tracker and key_moments about property restoration

Concept Snapshot

__serialize and __unserialize methods let PHP objects control serialization.
__serialize() returns an array of data to save.
__unserialize(array) restores object from that data.
Called automatically by serialize() and unserialize().
Use to customize what and how object data is saved.

Full Transcript

This visual trace shows how PHP uses __serialize and __unserialize methods during object serialization. First, an object is created with properties. When serialize() is called, PHP calls __serialize() to get an array of properties to save. This array is converted to a string for storage or transmission. Later, unserialize() converts the string back to an array and calls __unserialize() to restore the object's properties. The object is then ready to use with its original data. Key points include that __serialize controls what data is saved, and __unserialize must restore all needed properties to avoid broken objects.