Description

unserialize(string $data, array $options = []): mixed

unserialize() takes a single serialized variable and converts it back into a PHP value.

Warning

Do not pass untrusted user input to unserialize() regardless of the options value of allowed_classes. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.

If you need to unserialize externally-stored serialized data, consider using hash_hmac() for data validation. Make sure data is not modified by anyone but you.

Parameters

data

The serialized string.

If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists).

Note: unserialize_callback_func directive

The callback specified in the unserialize_callback_func directive is called when an undefined class is unserialized. If no callback is specified, the object will be instantiated as __PHP_Incomplete_Class.

options

Any options to be provided to unserialize(), as an associative array.

**Valid options**
Name	Type	Description
`allowed_classes`	array\|bool	Either an array of class names which should be accepted, `false` to accept no classes, or `true` to accept all classes. If this option is defined and unserialize() encounters an object of a class that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting this option is the same as defining it as `true`: PHP will attempt to instantiate objects of any class.
`max_depth`	int	The maximum depth of structures permitted during unserialization, and is intended to prevent stack overflows. The default depth limit is `4096` and can be disabled by setting `max_depth` to `0`.

Return Values

The converted value is returned, and can be a bool, int, float, string, array or object.

In case the passed string is not unserializeable, false is returned and E_WARNING is issued.

Errors/Exceptions

Objects may throw Throwables in their unserialization handlers.

As of PHP 8.4.0, if the allowed_classes element of options is not an array of class names, unserialize() throws TypeErrors and ValueErrors.

Changelog

Version Description

8.4.0 Now throws TypeErrors and ValueErrors if the allowed_classes element of options is not an array of class names.

8.3.0 Now emits E_WARNING when the input string has unconsumed data.

8.3.0 Now emits E_WARNING when the passed string is not unserializeable; previously E_NOTICE was emitted.

7.4.0 Added the max_depth element of options to set the maximum depth of structures permitted during unserialization.

7.1.0 The allowed_classes element of options is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize() returns false and issues an E_WARNING.

Version	Description
8.4.0	Now throws TypeErrors and ValueErrors if the `allowed_classes` element of `options` is not an array of class names.
8.3.0	Now emits `E_WARNING` when the input string has unconsumed data.
8.3.0	Now emits `E_WARNING` when the passed string is not unserializeable; previously `E_NOTICE` was emitted.
7.4.0	Added the `max_depth` element of `options` to set the maximum depth of structures permitted during unserialization.
7.1.0	The `allowed_classes` element of `options` is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize() returns `false` and issues an `E_WARNING`.

Examples

Example #1 unserialize() example

<?php
// Here, we use unserialize() to load session data to the
// $session_data array from the string selected from a database.
// This example complements the one described with serialize().

$conn = odbc_connect("webdb", "php", "chicken");
$stmt = odbc_prepare($conn, "SELECT data FROM sessions WHERE id = ?");
$sqldata = array($_SERVER['PHP_AUTH_USER']);
if (!odbc_execute($stmt, $sqldata) || !odbc_fetch_into($stmt, $tmp)) {
    // if the execute or fetch fails, initialize to empty array
    $session_data = array();
} else {
    // we should now have the serialized data in $tmp[0].
    $session_data = unserialize($tmp[0]);
    if (!is_array($session_data)) {
        // something went wrong, initialize to empty array
        $session_data = array();
    }
}
?>

Example #2 unserialize_callback_func example

<?php
$serialized_object='O:1:"a":1:{s:5:"value";s:3:"100";}';

ini_set('unserialize_callback_func', 'mycallback'); // set your callback_function

function mycallback($classname)
{
    // just include a file containing your class definition
    // you get $classname to figure out which class definition is required
    var_dump($classname);
}

unserialize($serialized_object);
?>

Notes