unserialize()

Introduction

The unserialize() function is a built-in PHP function that converts a string produced by serialize() back into the original PHP value — an array, object, string, number, or boolean.

Serialization is how PHP turns an in-memory value into a flat, storable string. You typically serialize() a value to write it to a file, a database column, or a cache, and then unserialize() it later to get the live value back. This page covers the syntax, working examples, how to restore objects safely, error handling, and the important security warning about untrusted input.

Syntax

mixed unserialize(string $data, array $options = [])

Return value: the restored PHP value. On failure it returns false and (since PHP 8.0) raises an E_WARNING. Because a valid serialized false is "b:0;", comparing against that string is the only reliable way to tell a real false from a failure.

Example: restoring an array

The serialized string below describes an array of three strings. unserialize() rebuilds it, and print_r() displays the result.

Output:

Array
(
    [0] => apple
    [1] => banana
    [2] => cherry
)

Reading the serialized format

Each token in the string is a type tag: a:3 is an array of 3 pairs, i:0 is the integer key 0, and s:5:"apple" is a 5-byte string. You rarely write this by hand — serialize() generates it — but knowing the shape helps you debug corrupted data.

Round trip with serialize()

In practice you serialize on the way out and unserialize on the way in. The restored value equals the original:

<?php
$user = ['name' => 'Ada', 'roles' => ['admin', 'editor']];

$stored  = serialize($user);          // save this string somewhere
$restored = unserialize($stored);     // read it back later

var_dump($restored === $user);
?>

Output:

bool(true)

Restoring objects

unserialize() can rebuild objects, not just arrays. The class must be loaded (or autoloadable) at the moment you unserialize; otherwise PHP creates an __PHP_Incomplete_Class placeholder that you cannot use.

<?php
class Point {
    public function __construct(public int $x, public int $y) {}
}

$data    = serialize(new Point(3, 4));
$point   = unserialize($data);

echo $point->x + $point->y;
?>

Output:

7

Restoring objects safely

Unserializing data that an attacker controls is dangerous: it can instantiate arbitrary classes and trigger their __wakeup() or __destruct() magic methods (a "PHP object injection" attack). The $options argument's allowed_classes key restricts what may be created:

<?php
// Refuse all objects — any object becomes __PHP_Incomplete_Class
$safe = unserialize($input, ['allowed_classes' => false]);

// Allow only specific classes
$safe = unserialize($input, ['allowed_classes' => [Point::class]]);
?>

Rule of thumb: never call unserialize() on user-supplied input without allowed_classes. If you only need to exchange plain data with untrusted sources, prefer json_decode(), which cannot instantiate PHP objects.

Handling errors

When the string is malformed, unserialize() returns false and emits a warning. Check the return value before using it:

<?php
$result = unserialize('not-valid-data');

if ($result === false) {
    echo "Could not unserialize the data";
} else {
    print_r($result);
}
?>

Output:

Could not unserialize the data

Since a genuinely stored false serializes to "b:0;", guard for it when false is a legitimate value:

<?php
$data   = serialize(false);   // "b:0;"
$result = unserialize($data);

if ($result === false && $data !== 'b:0;') {
    echo "Failure";
} else {
    echo "Restored a real false value";
}
?>

Output:

Restored a real false value

Conclusion

unserialize() reverses serialize(), turning a stored string back into a live PHP value such as an array or object. Remember two things: check the return value (comparing against "b:0;" to distinguish a real false from failure), and always pass allowed_classes — or switch to json_decode() — when the input is not fully trusted.

Practice