(PHP 4, PHP 5, PHP 7, PHP 8)
unserialize — Creates a PHP value from a stored representation
unserialize() takes a single serialized variable and converts it back into a PHP value.
Do not pass untrusted user input to unserialize() regardless
of the options value of allowed_classes.
Unserialization can result in code being loaded and executed due to object
instantiation and autoloading, and a malicious user may be able to exploit
this. Use a safe, standard data interchange format such as JSON (via
json_decode() and json_encode()) if
you need to pass serialized data to the user.
If you need to unserialize externally-stored serialized data, consider using hash_hmac() for data validation. Make sure data is not modified by anyone but you.
dataThe serialized string.
If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists).
Note: unserialize_callback_func directive
It's possible to set a callback-function which will be called, if an undefined class should be instantiated during unserializing. (to prevent getting an incomplete object "__PHP_Incomplete_Class".) Use your php.ini, ini_set() or .htaccess to define unserialize_callback_func. Everytime an undefined class should be instantiated, it'll be called. To disable this feature just empty this setting.
optionsAny options to be provided to unserialize(), as an associative array.
| Name | Type | Description |
|---|---|---|
allowed_classes |
mixed |
Either an array of class names which should be
accepted, false to accept no classes, or true to accept all
classes. If this option is defined and
unserialize() encounters an object of a class
that isn't to be accepted, then the object will be instantiated as
__PHP_Incomplete_Class instead.
Omitting this option is the same as defining it as true: PHP
will attempt to instantiate objects of any class.
|
max_depth |
int |
The maximum depth of structures permitted during unserialization,
and is intended to prevent stack overflows. The default depth limit
is 4096 and can be disabled by setting
max_depth to 0.
|
The converted value is returned, and can be a bool, int, float, string, array or object.
In case the passed string is not unserializeable, false is returned and
E_WARNING is issued.
Objects may throw Throwables in their unserialization handlers.
| Version | Description |
|---|---|
| 8.3.0 |
Now emits E_WARNING when the passed string is not unserializeable;
previously E_NOTICE was emitted.
|
| 7.4.0 |
Added the max_depth element of
options to set the maximum depth of structures permitted during unserialization.
|
| 7.1.0 |
The allowed_classes element of
options) is now strictly typed, i.e. if anything
other than an array or a bool is given,
unserialize() returns false and issues an
E_WARNING.
|
Example #1 unserialize() example
<?php
// Here, we use unserialize() to load session data to the
// $session_data array from the string selected from a database.
// This example complements the one described with serialize().
$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn, "SELECT data FROM sessions WHERE id = ?");
$sqldata = array($_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata) || !odbc_fetch_into($stmt, $tmp)) {
// if the execute or fetch fails, initialize to empty array
$session_data = array();
} else {
// we should now have the serialized data in $tmp[0].
$session_data = unserialize($tmp[0]);
if (!is_array($session_data)) {
// something went wrong, initialize to empty array
$session_data = array();
}
}
?>
Example #2 unserialize_callback_func example
<?php
$serialized_object='O:1:"a":1:{s:5:"value";s:3:"100";}';
ini_set('unserialize_callback_func', 'mycallback'); // set your callback_function
function mycallback($classname)
{
// just include a file containing your class definition
// you get $classname to figure out which class definition is required
}
?>