PHP serialize() Function

PHP

PHP serialize() - Serialize Variable

The serialize() function in PHP is an essential tool to convert complex variables such as arrays and objects into a storable string format. This serialized string can be stored in files, cached, or saved in databases and later restored with unserialize(). Whether you're handling session data, caching variables, or communicating between different PHP processes, understanding how serialize() works is vital.

Prerequisites

  • Basic knowledge of PHP syntax and variables
  • Understanding of arrays and objects in PHP
  • PHP environment set up (PHP 7.x or later recommended)

Setup

To start using the serialize() function, no special setup is needed beyond having PHP installed on your machine or server. This function is built into the core PHP language.

Understanding the PHP serialize() Function

The serialize() function takes a PHP variable and converts it into a string representation that encodes its type and value. This string can then be stored or transmitted and later restored using unserialize(). It works with all variable types: integers, floats, strings, arrays, objects, and even resource types (though resources cannot be restored exactly). 

mixed serialize ( mixed $value )

- $value: The variable you want to serialize.
- Returns a string representation of the variable.

Examples: Using serialize() in PHP

Example 1: Serializing a Simple Array

<?php
$array = ['apple', 'banana', 'cherry'];
$serialized = serialize($array);
echo $serialized;
?>

Output:

a:3:{i:0;s:5:"apple";i:1;s:6:"banana";i:2;s:6:"cherry";}

Explanation:

The serialized string describes an array (a) of length 3. Each element has its index and string length details encoded.

Example 2: Serializing an Object

<?php
class Person {
    public $name;
    public $age;
    public function __construct($name, $age) {
        $this->name = $name;
        $this->age = $age;
    }
}

$person = new Person("Alice", 30);
$serializedPerson = serialize($person);
echo $serializedPerson;
?>

Output:

O:6:"Person":2:{s:4:"name";s:5:"Alice";s:3:"age";i:30;}

Explanation:

The serialized string encodes the object with class name and its properties.

Example 3: Storing Serialized Data in a File and Retrieving It

<?php
// Data to serialize
$data = ['key1' => 'value1', 'key2' => 'value2'];

// Serialize and save to file
file_put_contents('data.txt', serialize($data));

// Later on, read and unserialize
$stored = file_get_contents('data.txt');
$restored = unserialize($stored);

print_r($restored);
?>

Output:

Array
(
    [key1] => value1
    [key2] => value2
)

Best Practices

  • Always validate data before unserializing to avoid security risks, such as object injection attacks.
  • Use serialize() for storing complex data structures when you cannot use JSON (e.g., when preserving PHP objects).
  • Do not rely on serialized strings for data interchange between different programming languages; prefer JSON for inter-language communication.
  • Be cautious when unserializing data from untrusted sources.
  • Prefer using json_encode() and json_decode() if you only need to store and retrieve data structures (arrays, objects without methods) and want better interoperability.

Common Mistakes

  • Attempting to serialize resource types (like database connections); resources cannot be serialized and will be lost.
  • Unserializing user input without validation or sanitization.
  • Confusing serialize() with json_encode()—they serve different purposes.
  • Ignoring the impact of class changes on serialized object strings (modifying the class structure can cause unserialization errors).
  • Using serialize to send data between unrelated systems without considering compatibility issues.

Interview Questions

Junior Level

  • Q1: What does the serialize() function do in PHP?
    A: It converts a PHP variable into a storable string representation.
  • Q2: Can you serialize a PHP array?
    A: Yes, arrays can be serialized into a string.
  • Q3: What function do you use to restore serialized data?
    A: unserialize().
  • Q4: Is it safe to unserialize data from user input?
    A: No, because it could lead to security vulnerabilities.
  • Q5: Can you serialize PHP objects?
    A: Yes, objects can be serialized along with their class data and properties.

Mid Level

  • Q1: What types of PHP variables cannot be serialized?
    A: Resource types like database connections cannot be serialized.
  • Q2: How does the serialized representation help when storing PHP variables?
    A: It provides a string format that preserves the type and structure, making storage or transfer easier.
  • Q3: What are the differences between serialize() and json_encode() in PHP?
    A: serialize() can handle PHP objects and preserves PHP-specific types; JSON is language-independent but cannot serialize PHP objects with methods.
  • Q4: How can you protect against security risks when using unserialize()?
    A: Validate input, use allowed classes lists, or prefer safer alternatives like JSON.
  • Q5: What happens if you unserialize a string that no longer matches the class structure?
    A: PHP will throw errors or may produce incomplete objects.

Senior Level

  • Q1: Describe a security vulnerability associated with unserialize() and how to mitigate it.
    A: Object injection attacks occur by unserializing crafted input; mitigate by disabling __wakeup(), using allowed classes, or avoiding unserialize on untrusted data.
  • Q2: How would you implement versioning or backward compatibility with serialized object data?
    A: Use class methods like __sleep() and __wakeup() to manage serialization, store version info as properties, and handle differences during unserialization.
  • Q3: Explain the process of serializing objects with references and circular references in PHP.
    A: PHP handles references by encoding them; circular references are supported natively by serialize and correctly restored by unserialize.
  • Q4: When would you prefer serialization over JSON encoding in PHP applications?
    A: When you need to preserve PHP-specific data types like objects with methods, private/protected properties, or resource-related metadata.
  • Q5: How does PHP internally represent serialized data for objects, and what implications does this have for refactoring?
    A: PHP stores the class name and properties; changing the class name or property visibility breaks unserialization, so refactoring requires care or migration strategies.

Frequently Asked Questions (FAQ)

Q1: Can you serialize and unserialize a PHP resource?

No, resources like database connections cannot be serialized because they represent external references that cannot be meaningfully converted to string.

Q2: Is the serialized string human-readable?

Not fully—it is a structured string encoding type and length information, which is more technical than friendly human-readable formats like JSON.

Q3: What happens if the class definition is missing when unserializing an object?

PHP will create an instance of a __PHP_Incomplete_Class object, which lacks the original class’s methods and properties.

Q4: Can serialized data be stored directly in a database?

Yes, serialized strings are plain strings and can be stored in text or blob fields in databases.

Q5: How do I convert serialized data into JSON?

First unserialize the string to restore the variable, then encode it to JSON using json_encode(). Note that complex PHP objects may not convert well to JSON.

Conclusion

PHP’s serialize() function is a powerful feature to generate storable string representations of variables, enabling efficient variable storage in files, caches, or databases. Proper usage and care can help you safely save and retrieve complex data, especially objects. Remember to always handle serialized data securely, validating input and considering alternatives such as JSON for interoperability. Mastery of serialization is a key skill in PHP variable handling.