unserialize

Creates a PHP value from a stored representation

&reftitle.description; `mixed` `unserialize` `string` `data` `array` `options`[]

`unserialize` takes a single serialized variable and converts it back into a PHP value.

Do not pass untrusted user input to `unserialize` regardless of the `options` value of `allowed_classes`. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via `json_decode` and `json_encode`) if you need to pass serialized data to the user.

If you need to unserialize externally-stored serialized data, consider using `hash_hmac` for data validation. Make sure data is not modified by anyone but you.

&reftitle.parameters;

`data`

- The serialized string.

  If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists).

  ### unserialize_callback_func directive

  It's possible to set a callback-function which will be called, if an undefined class should be instantiated during unserializing. (to prevent getting an incomplete `object` "__PHP_Incomplete_Class".) Use your &php.ini;, `ini_set` or &htaccess; to define unserialize_callback_func. Everytime an undefined class should be instantiated, it'll be called. To disable this feature just empty this setting.

`options`

- Any options to be provided to `unserialize`, as an associative array.

  ## Valid options

  Name | Type | Description
  `allowed_classes` | `mixed` | Either an `array` of class names which should be accepted, &false; to accept no classes, or &true; to accept all classes. If this option is defined and `unserialize` encounters an object of a class that isn't to be accepted, then the object will be instantiated as `__PHP_Incomplete_Class` instead. Omitting this option is the same as defining it as &true;: PHP will attempt to instantiate objects of any class.
  `max_depth` | `int` | The maximum depth of structures permitted during unserialization, and is intended to prevent stack overflows. The default depth limit is `4096` and can be disabled by setting `max_depth` to `0`.

&reftitle.returnvalues;

The converted value is returned, and can be a `bool`, `int`, `float`, `string`, `array` or `object`.

In case the passed string is not unserializeable, &false; is returned and `E_NOTICE` is issued.

&reftitle.errors;

Objects may throw `Throwable`s in their unserialization handlers.

&reftitle.changelog;

&Version; | &Description;
7.4.0 | Added the `max_depth` element of `options` to set the maximum depth of structures permitted during unserialization.
7.1.0 | The `allowed_classes` element of `options`) is now strictly typed, i.e. if anything other than an `array` or a `bool` is given, `unserialize` returns &false; and issues an `E_WARNING`.

&reftitle.examples;

### `unserialize` example

    <?php
    // Here, we use unserialize() to load session data to the
    // $session_data array from the string selected from a database.
    // This example complements the one described with serialize().

    $conn = odbc_connect("webdb", "php", "chicken");
    $stmt = odbc_prepare($conn, "SELECT data FROM sessions WHERE id = ?");
    $sqldata = array($_SERVER['PHP_AUTH_USER']);
    if (!odbc_execute($stmt, $sqldata) || !odbc_fetch_into($stmt, $tmp)) {
        // if the execute or fetch fails, initialize to empty array
        $session_data = array();
    } else {
        // we should now have the serialized data in $tmp[0].
        $session_data = unserialize($tmp[0]);
        if (!is_array($session_data)) {
            // something went wrong, initialize to empty array
            $session_data = array();
        }
    }
    ?>

### unserialize_callback_func example

    <?php
    $serialized_object='O:1:"a":1:{s:5:"value";s:3:"100";}';

    ini_set('unserialize_callback_func', 'mycallback'); // set your callback_function

    function mycallback($classname)
    {
        // just include a file containing your class definition
        // you get $classname to figure out which class definition is required
    }
    ?>

&reftitle.notes;

&false; is returned both in the case of an error and if unserializing the serialized &false; value. It is possible to catch this special case by comparing `data` with `serialize(false)` or by catching the issued `E_NOTICE`.

&reftitle.seealso;

- `json_encode`
- `json_decode`
- `hash_hmac`
- `serialize`
- Autoloading Classes
- unserialize_callback_func
- unserialize_max_depth
- __wakeup()
- __serialize()
- __unserialize()