Creates a PHP value from a stored representation

- « strval

- unset »

- PHP Manual
- Variable handling Functions
- Creates a PHP value from a stored representation

# unserialize

(PHP 4, PHP 5, PHP 7, PHP 8)

unserialize — Creates a PHP value from a stored representation

### Description

unserialize(string `$data`, array `$options` = []): mixed

unserialize() takes a single serialized variable and converts it back into a PHP value.

Warning

Do not pass untrusted user input to unserialize() regardless of the `options` value of `allowed_classes`. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.

If you need to unserialize externally-stored serialized data, consider using hash_hmac() for data validation. Make sure data is not modified by anyone but you.

### Parameters

`data`

  The serialized string.

  If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists).

  > Note: unserialize_callback_func directive

  > The callback specified in the unserialize_callback_func directive is called when an undefined class is unserialized. If no callback is specified, the object will be instantiated as __PHP_Incomplete_Class.

`options`

  Any options to be provided to unserialize(), as an associative array.

  Valid options
  Name | Type | Description
  --- | --- | ---

  `allowed_classes`

  mixed

  Either an array of class names which should be accepted, `false` to accept no classes, or `true` to accept all classes. If this option is defined and unserialize() encounters an object of a class that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting this option is the same as defining it as `true`: PHP will attempt to instantiate objects of any class.

  `max_depth` | int | The maximum depth of structures permitted during unserialization, and is intended to prevent stack overflows. The default depth limit is `4096` and can be disabled by setting `max_depth` to `0`.

### Return Values

The converted value is returned, and can be a bool, int, float, string, array or object.

In case the passed string is not unserializeable, `false` is returned and `E_WARNING` is issued.

### Errors/Exceptions

Objects may throw Throwables in their unserialization handlers.

### Changelog

Version | Description
--- | ---
8.3.0 | Now emits `E_WARNING` when the input string has unconsumed data.
8.3.0 | Now emits `E_WARNING` when the passed string is not unserializeable; previously `E_NOTICE` was emitted.
7.4.0 | Added the `max_depth` element of `options` to set the maximum depth of structures permitted during unserialization.
7.1.0 | The `allowed_classes` element of `options`) is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize() returns `false` and issues an `E_WARNING`.

### Examples

Example #1 unserialize() example

    <?php
    // Here, we use unserialize() to load session data to the
    // $session_data array from the string selected from a database.
    // This example complements the one described with serialize().

    $conn = odbc_connect("webdb", "php", "chicken");
    $stmt = odbc_prepare($conn, "SELECT data FROM sessions WHERE id = ?");
    $sqldata = array($_SERVER['PHP_AUTH_USER']);
    if (!odbc_execute($stmt, $sqldata) || !odbc_fetch_into($stmt, $tmp)) {
        // if the execute or fetch fails, initialize to empty array
        $session_data = array();
    } else {
        // we should now have the serialized data in $tmp[0].
        $session_data = unserialize($tmp[0]);
        if (!is_array($session_data)) {
            // something went wrong, initialize to empty array
            $session_data = array();
        }
    }
    ?>

Example #2 unserialize_callback_func example

    <?php
    $serialized_object='O:1:"a":1:{s:5:"value";s:3:"100";}';

    ini_set('unserialize_callback_func', 'mycallback'); // set your callback_function

    function mycallback($classname)
    {
        // just include a file containing your class definition
        // you get $classname to figure out which class definition is required
    }
    ?>

### Notes

Warning

`false` is returned both in the case of an error and if unserializing the serialized `false` value. It is possible to catch this special case by comparing `data` with `serialize(false)` or by catching the issued `E_NOTICE`.

### See Also

- json_encode() - Returns the JSON representation of a value
- json_decode() - Decodes a JSON string
- hash_hmac() - Generate a keyed hash value using the HMAC method
- serialize() - Generates a storable representation of a value
- Autoloading Classes
- unserialize_callback_func
- unserialize_max_depth
- __wakeup()
- __serialize()
- __unserialize()