Serialize objects

serialize()

The serialize function turns a value into a storable string. A file or cache cell can hold the string until you need the value again.

The unserialize function rebuilds the value from that string. Both calls below work on plain data with no objects involved.

$data = ["a" => 1, "b" => 2]; $text = serialize($data); $back = unserialize($text);

__serialize

The __serialize method returns the array that serialize stores, and __unserialize restores state from it. The pair shapes exactly what leaves the object.

Skip handles and secrets in that array. Stored data should hold facts, not live resources.

class Token { public string $id = "abc"; public function __serialize(): array { return ["id" => $this->id]; } public function __unserialize(array $data): void { $this->id = $data["id"]; } }

JsonSerializable

The json_encode function calls jsonSerialize when the object uses the interface. The method returns plain arrays and scalars.

Any client can read that output, which makes JSON the default for APIs and logs.

class User implements JsonSerializable { public function __construct(public string $name) {} public function jsonSerialize(): mixed { return ["name" => $this->name]; } }

Never unserialize input

Never pass request data to unserialize. The format can build objects and reach code paths you did not plan.

Decode JSON for input instead. Plain arrays carry the same facts with none of the object risk.

$data = json_decode($body, true); echo $data["name"];

Next: Late static binding

Article author: Arthur Isaev