Serialize: PHP's Serialization Format

Download as docx, pdf, or txt
Download as docx, pdf, or txt
You are on page 1of 5

Serialize

serialize — Generates a storable representation of a value

Generates a storable representation of a value.

This is useful for storing or passing PHP values around without losing their type and
structure.

To make the serialized string into a PHP value again, use unserialize().

Note:
Object's private members have the class name prepended to the member name;
protected members have a '*' prepended to the member name. These prepended
values have null bytes on either side.

PHP’s serialization format

You probably already know how the output of serialize() roughly looks like: It has
some kind of type specifier (like s or i), followed by a colon, followed by the actual data,
followed by a semicolon. As such the serialization format for the “simple” types looks as
follows:

NULL: N;

true: b:1;

false: b:0;

42: i:42;

42.3789: d:42.378900000000002;

^-- Precision controlled by serialize_precision ini setting


(default 17)

"foobar": s:6:"foobar";

^-- strlen("foobar")

resource: i:0;
^-- Resources can't really be serialized, so they just get the
value int(0)

For arrays a list of key-value pairs is contained in curly braces:

[10, 11, 12]: a:3:{i:0;i:10;i:1;i:11;i:2;i:12;}

^-- count([10, 11, 12])

v-- key v-- value

["foo" => 4, "bar" => 2]: a:2:{s:3:"foo";i:4;s:3:"bar";i:2;}

^-- key ^-- value

For objects there are two serialization mechanisms: The first one simply serializes the
object properties just like it is done for arrays. This mechanism uses O as the type
specifier.

Consider the following class:

<?php

class Test {

public $public = 1;

protected $protected = 2;

private $private = 3;

This is serialized as follows:

v-- strlen("Test") v-- property v-- value

O:4:"Test":3:{s:6:"public";i:1;s:12:"\0*\0protected";i:2;s:13:"\0Test\
0private";i:3;}

^-- property ^-- value ^-- property


^-- value
The \0 in the above serialization string are NUL bytes. As you can see private and
protected members are serialized with rather peculiar names: Private properties are
prefixed with \0ClassName\0 and protected properties with \0*\0. These names are
the result of name mangling, which is something we’ll cover in a later section.

The second mechanism allows for custom serialization formats. It delegates the actual
serialization to the serialize method of the Serializable interface and uses
the C type specifier. For example consider this class:

<?php

class Test2 implements Serializable {

public function serialize() {

return "foobar";

public function unserialize($str) {

// ...

It will be serialized as follows:

C:5:"Test2":6:{foobar}

^-- strlen("foobar")

In this case PHP will just put the result of the Serializable::serialize() call


inside the curly braces.

The Serializable interface 


(PHP 5 >= 5.1.0, PHP 7)

Introduction 

Interface for customized serializing.


Classes that implement this interface no longer support __sleep() and __wakeup(). The
method serialize is called whenever an instance needs to be serialized. This does not
invoke __destruct() or has any other side effect unless programmed inside the method.
When the data is unserialized the class is known and the appropriate unserialize()
method is called as a constructor instead of calling __construct(). If you need to execute
the standard constructor you may do so in the method.

Note, that when an old instance of a class that implements this interface now, which had
been serialized before the class implemeted the interface, is unserialized, __wakeup() is
called instead of the serialize method, what might be useful for migration purposes.

Interface synopsis
Serializable {

/* Methods */

abstract public string serialize ( void )

abstract public void unserialize ( string $serialized )

Example #1 Basic usage

<?php
class obj implements Serializable {
    private $data;
    public function __construct() {
        $this->data = "My private data";
    }
    public function serialize() {
        return serialize($this->data);
    }
    public function unserialize($data) {
        $this->data = unserialize($data);
    }
    public function getData() {
        return $this->data;
    }
}

$obj = new obj;
$ser = serialize($obj);

var_dump($ser);

$newobj = unserialize($ser);
var_dump($newobj->getData());
?>

The above example will output something similar to:

string(38) "C:3:"obj":23:{s:15:"My private data";}"


string(15) "My private data"

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy