unserialize Creates a PHP value from a stored representation &reftitle.description; mixedunserialize stringdata arrayoptions[] unserialize takes a single serialized variable and converts it back into a PHP value. Do not pass untrusted user input to unserialize regardless of the options value of allowed_classes. Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode and json_encode) if you need to pass serialized data to the user. If you need to unserialize externally-stored serialized data, consider using hash_hmac for data validation. Make sure data is not modified by anyone but you. &reftitle.parameters; data The serialized string. If the variable being unserialized is an object, after successfully reconstructing the object PHP will automatically attempt to call the __unserialize() or __wakeup() methods (if one exists). The callback specified in the unserialize_callback_func directive is called when an undefined class is unserialized. If no callback is specified, the object will be instantiated as __PHP_Incomplete_Class. options Any options to be provided to unserialize, as an associative array. Name Type Description allowed_classes arraybool Either an array of class names which should be accepted, &false; to accept no classes, or &true; to accept all classes. If this option is defined and unserialize encounters an object of a class that isn't to be accepted, then the object will be instantiated as __PHP_Incomplete_Class instead. Omitting this option is the same as defining it as &true;: PHP will attempt to instantiate objects of any class. This option does not affect Enumerations. max_depth int The maximum depth of structures permitted during unserialization, and is intended to prevent stack overflows. The default depth limit is 4096 and can be disabled by setting max_depth to 0. &reftitle.returnvalues; The converted value is returned, and can be a bool, int, float, string, array or object. In case the passed string is not unserializeable, &false; is returned and E_WARNING is issued. &reftitle.errors; Objects may throw Throwables in their unserialization handlers. As of PHP 8.4.0, if the allowed_classes element of options is neither an array of class names nor a bool, unserialize throws TypeError and ValueError. &reftitle.changelog; &Version; &Description; 8.4.0 Now throws TypeError and ValueError if the allowed_classes element of options is neither an array of class names nor a bool. 8.4.0 Unserializing strings using the uppercase "S" tag is now deprecated; use the lowercase "s" tag instead. 8.3.0 Now emits E_WARNING when the input string has unconsumed data. 8.3.0 Now emits E_WARNING when the passed string is not unserializeable; previously E_NOTICE was emitted. 7.4.0 Added the max_depth element of options to set the maximum depth of structures permitted during unserialization. 7.1.0 The allowed_classes element of options is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize returns &false; and issues an E_WARNING. &reftitle.examples; ]]> ]]> &reftitle.notes; &false; is returned both in the case of an error and if unserializing the serialized &false; value. It is possible to catch this special case by comparing data with serialize(false) or by catching the issued E_WARNING. &reftitle.seealso; json_encode json_decode hash_hmac serialize Autoloading Classes unserialize_callback_func unserialize_max_depth __wakeup() __serialize() __unserialize()