PHP unserialize Explained

What PHP unserialize does, where serialized data appears, and how to avoid unsafe usage.

PHP unserialize() rebuilds a PHP value from a serialized string. It is useful for legacy data but needs care.

Common scenarios

$value = unserialize($payload, ['allowed_classes' => false]);

Never call unserialize() on untrusted user input with classes enabled. Prefer JSON for new storage and APIs.

Is unserialize dangerous?

It can be dangerous with untrusted data, especially when object classes are allowed.

What should I use for new data formats?

JSON is usually easier to inspect and safer for interchange.

Decode simple PHP serialized strings into readable structured data directly in your browser.

View PHP serialized data as an indented tree for debugging nested arrays and objects.

Examples of PHP serialized strings for arrays, strings, booleans, nulls, and nested values.