<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>Creates a PHP value from a stored representation</title>
</head>
<body><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="function.strval.html">strval</a></div>
<div class="next" style="text-align: right; float: right;"><a href="function.unset.html">unset</a></div>
<div class="up"><a href="ref.var.html">Variable handling Functions</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div><hr /><div id="function.unserialize" class="refentry">
<div class="refnamediv">
<h1 class="refname">unserialize</h1>
<p class="verinfo">(PHP 4, PHP 5, PHP 7)</p><p class="refpurpose"><span class="refname">unserialize</span> — <span class="dc-title">
Creates a PHP value from a stored representation
</span></p>
</div>
<div class="refsect1 description" id="refsect1-function.unserialize-description">
<h3 class="title">Description</h3>
<div class="methodsynopsis dc-description">
<span class="type"><a href="language.pseudo-types.html#language.types.mixed" class="type mixed">mixed</a></span> <span class="methodname"><strong>unserialize</strong></span>
( <span class="methodparam"><span class="type">string</span> <code class="parameter">$str</code></span>
[, <span class="methodparam"><span class="type">array</span> <code class="parameter">$options</code></span>
] )</div>
<p class="simpara">
<span class="function"><strong>unserialize()</strong></span> takes a single serialized variable and
converts it back into a PHP value.
</p>
<div class="warning"><strong class="warning">Warning</strong>
<p class="para">
Do not pass untrusted user input to <span class="function"><strong>unserialize()</strong></span> regardless
of the <code class="parameter">options</code> value of <em>allowed_classes</em>.
Unserialization can result in code being loaded and executed due to object
instantiation and autoloading, and a malicious user may be able to exploit
this. Use a safe, standard data interchange format such as JSON (via
<span class="function"><a href="function.json-decode.html" class="function">json_decode()</a></span> and <span class="function"><a href="function.json-encode.html" class="function">json_encode()</a></span>) if
you need to pass serialized data to the user.
</p>
<p class="para">
If you need to unserialize externally-stored serialized data, consider using
<span class="function"><a href="function.hash-hmac.html" class="function">hash_hmac()</a></span> for data validation. Make sure data is
not modified by anyone but you.
</p>
</div>
</div>
<div class="refsect1 parameters" id="refsect1-function.unserialize-parameters">
<h3 class="title">Parameters</h3>
<p class="para">
<dl>
<dt>
<code class="parameter">str</code></dt>
<dd>
<p class="para">
The serialized string.
</p>
<p class="para">
If the variable being unserialized is an object, after successfully
reconstructing the object PHP will automatically attempt to call the
<a href="language.oop5.magic.html#object.wakeup" class="link">__wakeup()</a> member
function (if it exists).
</p>
<p class="para">
<blockquote class="note"><p><strong class="note">Note</strong>:
<strong>unserialize_callback_func directive</strong><br />
<p class="para">
It's possible to set a callback-function which will be called,
if an undefined class should be instantiated during unserializing.
(to prevent getting an incomplete <span class="type"><a href="language.types.object.html" class="type object">object</a></span> "__PHP_Incomplete_Class".)
Use your <var class="filename">php.ini</var>, <span class="function"><a href="function.ini-set.html" class="function">ini_set()</a></span> or <var class="filename">.htaccess</var>
to define <a href="var.configuration.html#ini.unserialize-callback-func" class="link">unserialize_callback_func</a>.
Everytime an undefined class should be instantiated, it'll be called. To disable this feature just
empty this setting.
</p>
</p></blockquote>
</p>
</dd>
<dt>
<code class="parameter">options</code></dt>
<dd>
<p class="para">
Any options to be provided to <span class="function"><strong>unserialize()</strong></span>, as an
associative array.
</p>
<table class="doctable table">
<caption><strong>Valid options</strong></caption>
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody class="tbody">
<tr>
<td><em>allowed_classes</em></td>
<td><span class="type"><a href="language.pseudo-types.html#language.types.mixed" class="type mixed">mixed</a></span></td>
<td>
<span class="simpara">
Either an <span class="type"><a href="language.types.array.html" class="type array">array</a></span> of class names which should be
accepted, <strong><code>FALSE</code></strong> to accept no classes, or <strong><code>TRUE</code></strong> to accept all
classes. If this option is defined and
<span class="function"><strong>unserialize()</strong></span> encounters an object of a class
that isn't to be accepted, then the object will be instantiated as
<strong class="classname">__PHP_Incomplete_Class</strong> instead.
</span>
<span class="simpara">
Omitting this option is the same as defining it as <strong><code>TRUE</code></strong>: PHP
will attempt to instantiate objects of any class.
</span>
</td>
</tr>
</tbody>
</table>
</dd>
</dl>
</p>
</div>
<div class="refsect1 returnvalues" id="refsect1-function.unserialize-returnvalues">
<h3 class="title">Return Values</h3>
<p class="para">
The converted value is returned, and can be a <span class="type"><a href="language.types.boolean.html" class="type boolean">boolean</a></span>,
<span class="type"><a href="language.types.integer.html" class="type integer">integer</a></span>, <span class="type"><a href="language.types.float.html" class="type float">float</a></span>, <span class="type"><a href="language.types.string.html" class="type string">string</a></span>,
<span class="type"><a href="language.types.array.html" class="type array">array</a></span> or <span class="type"><a href="language.types.object.html" class="type object">object</a></span>.
</p>
<p class="para">
In case the passed string is not unserializeable, <strong><code>FALSE</code></strong> is returned and
<strong><code>E_NOTICE</code></strong> is issued.
</p>
</div>
<div class="refsect1 changelog" id="refsect1-function.unserialize-changelog">
<h3 class="title">Changelog</h3>
<p class="para">
<table class="doctable informaltable">
<thead>
<tr>
<th>Version</th>
<th>Description</th>
</tr>
</thead>
<tbody class="tbody">
<tr>
<td>7.1.0</td>
<td>
The <em>allowed_classes</em> element of
<code class="parameter">options</code>) is now strictly typed, i.e. if anything
other than an <span class="type"><a href="language.types.array.html" class="type array">array</a></span> or a <span class="type"><a href="language.types.boolean.html" class="type boolean">boolean</a></span> is given,
<span class="function"><strong>unserialize()</strong></span> returns <strong><code>FALSE</code></strong> and issues an
<strong><code>E_WARNING</code></strong>.
</td>
</tr>
<tr>
<td>7.0.0</td>
<td>
The <code class="parameter">options</code> parameter has been added.
</td>
</tr>
<tr>
<td>5.6.0</td>
<td>
Manipulating the serialised data by replacing <em>C:</em>
with <em>O:</em> to force object instantiation without
calling the constructor will now fail.
</td>
</tr>
</tbody>
</table>
</p>
</div>
<div class="refsect1 examples" id="refsect1-function.unserialize-examples">
<h3 class="title">Examples</h3>
<p class="para">
<div class="example" id="example-6517">
<p><strong>Example #1 <span class="function"><strong>unserialize()</strong></span> example</strong></p>
<div class="example-contents">
<div class="phpcode"><code><span style="color: #000000">
<span style="color: #0000BB"><?php<br /></span><span style="color: #FF8000">// Here, we use unserialize() to load session data to the<br />// $session_data array from the string selected from a database.<br />// This example complements the one described with serialize().<br /><br /></span><span style="color: #0000BB">$conn </span><span style="color: #007700">= </span><span style="color: #0000BB">odbc_connect</span><span style="color: #007700">(</span><span style="color: #DD0000">"webdb"</span><span style="color: #007700">, </span><span style="color: #DD0000">"php"</span><span style="color: #007700">, </span><span style="color: #DD0000">"chicken"</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">$stmt </span><span style="color: #007700">= </span><span style="color: #0000BB">odbc_prepare</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">, </span><span style="color: #DD0000">"SELECT data FROM sessions WHERE id = ?"</span><span style="color: #007700">);<br /></span><span style="color: #0000BB">$sqldata </span><span style="color: #007700">= array(</span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'PHP_AUTH_USER'</span><span style="color: #007700">]);<br />if (!</span><span style="color: #0000BB">odbc_execute</span><span style="color: #007700">(</span><span style="color: #0000BB">$stmt</span><span style="color: #007700">, </span><span style="color: #0000BB">$sqldata</span><span style="color: #007700">) || !</span><span style="color: #0000BB">odbc_fetch_into</span><span style="color: #007700">(</span><span style="color: #0000BB">$stmt</span><span style="color: #007700">, </span><span style="color: #0000BB">$tmp</span><span style="color: #007700">)) {<br /> </span><span style="color: #FF8000">// if the execute or fetch fails, initialize to empty array<br /> </span><span style="color: #0000BB">$session_data </span><span style="color: #007700">= array();<br />} else {<br /> </span><span style="color: #FF8000">// we should now have the serialized data in $tmp[0].<br /> </span><span style="color: #0000BB">$session_data </span><span style="color: #007700">= </span><span style="color: #0000BB">unserialize</span><span style="color: #007700">(</span><span style="color: #0000BB">$tmp</span><span style="color: #007700">[</span><span style="color: #0000BB">0</span><span style="color: #007700">]);<br /> if (!</span><span style="color: #0000BB">is_array</span><span style="color: #007700">(</span><span style="color: #0000BB">$session_data</span><span style="color: #007700">)) {<br /> </span><span style="color: #FF8000">// something went wrong, initialize to empty array<br /> </span><span style="color: #0000BB">$session_data </span><span style="color: #007700">= array();<br /> }<br />}<br /></span><span style="color: #0000BB">?></span>
</span>
</code></div>
</div>
</div>
</p>
<p class="para">
<div class="example" id="example-6518">
<p><strong>Example #2 unserialize_callback_func example</strong></p>
<div class="example-contents">
<div class="phpcode"><code><span style="color: #000000">
<span style="color: #0000BB"><?php<br />$serialized_object</span><span style="color: #007700">=</span><span style="color: #DD0000">'O:1:"a":1:{s:5:"value";s:3:"100";}'</span><span style="color: #007700">;<br /><br /></span><span style="color: #0000BB">ini_set</span><span style="color: #007700">(</span><span style="color: #DD0000">'unserialize_callback_func'</span><span style="color: #007700">, </span><span style="color: #DD0000">'mycallback'</span><span style="color: #007700">); </span><span style="color: #FF8000">// set your callback_function<br /><br /></span><span style="color: #007700">function </span><span style="color: #0000BB">mycallback</span><span style="color: #007700">(</span><span style="color: #0000BB">$classname</span><span style="color: #007700">) <br />{<br /> </span><span style="color: #FF8000">// just include a file containing your classdefinition<br /> // you get $classname to figure out which classdefinition is required<br /></span><span style="color: #007700">}<br /></span><span style="color: #0000BB">?></span>
</span>
</code></div>
</div>
</div>
</p>
</div>
<div class="refsect1 notes" id="refsect1-function.unserialize-notes">
<h3 class="title">Notes</h3>
<div class="warning"><strong class="warning">Warning</strong>
<p class="para">
<strong><code>FALSE</code></strong> is returned both in the case of an error and if unserializing
the serialized <strong><code>FALSE</code></strong> value. It is possible to catch this special case by
comparing <code class="parameter">str</code> with
<em>serialize(false)</em> or by catching the issued
<strong><code>E_NOTICE</code></strong>.
</p>
</div>
</div>
<div class="refsect1 seealso" id="refsect1-function.unserialize-seealso">
<h3 class="title">See Also</h3>
<p class="para">
<ul class="simplelist">
<li class="member"><span class="function"><a href="function.json-encode.html" class="function" rel="rdfs-seeAlso">json_encode()</a> - Returns the JSON representation of a value</span></li>
<li class="member"><span class="function"><a href="function.json-decode.html" class="function" rel="rdfs-seeAlso">json_decode()</a> - Decodes a JSON string</span></li>
<li class="member"><span class="function"><a href="function.hash-hmac.html" class="function" rel="rdfs-seeAlso">hash_hmac()</a> - Generate a keyed hash value using the HMAC method</span></li>
<li class="member"><span class="function"><a href="function.serialize.html" class="function" rel="rdfs-seeAlso">serialize()</a> - Generates a storable representation of a value</span></li>
<li class="member"><a href="language.oop5.autoload.html" class="link">Autoloading Classes</a></li>
<li class="member"><a href="var.configuration.html#ini.unserialize-callback-func" class="link">unserialize_callback_func</a></li>
<li class="member"><a href="language.oop5.magic.html#object.wakeup" class="link">__wakeup()</a></li>
</ul>
</p>
</div>
</div><hr /><div class="manualnavbar" style="text-align: center;">
<div class="prev" style="text-align: left; float: left;"><a href="function.strval.html">strval</a></div>
<div class="next" style="text-align: right; float: right;"><a href="function.unset.html">unset</a></div>
<div class="up"><a href="ref.var.html">Variable handling Functions</a></div>
<div class="home"><a href="index.html">PHP Manual</a></div>
</div></body></html>
