serialize() / unserialize()

PHP CWE-502 OWASP A8:2021 CVSS 9.8 PHP 5.0+ Intermediate

debt(d5/e3/b5/t7)

d5 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'specialist tool catches' (d5), semgrep/psalm/phpstan rules can flag unserialize() on untrusted input, but it's silent at runtime and not caught by default linters.

e3 Effort Remediation debt — work required to fix once spotted

Closest to 'simple parameterised fix' (e3), quick_fix is replacing serialize/unserialize with json_encode/json_decode — a pattern swap, but it touches each call site and may require data migration if serialized data is already persisted.

b5 Burden Structural debt — long-term weight of choosing wrong

Closest to 'persistent productivity tax' (b5), applies across web/cli/queue contexts; once serialized data is stored in DB/cookies/sessions, the format choice shapes ongoing maintenance and migration work.

t7 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'serious trap' (t7), the misconception that serialize() is safe for caching contradicts safer norms in other languages — unserialize() silently instantiates arbitrary classes and triggers magic methods, enabling object injection in a way most devs don't anticipate.

About DEBT scoring → scored by claude-opus-4-7 · 2026-05-11 · reviewed by human

Also Known As

serialize() unserialize() PHP object serialization

TL;DR

PHP's native serialisation functions can trigger arbitrary code execution via magic methods when deserialising untrusted data.

Explanation

unserialize() reconstructs PHP objects from a string, invoking magic methods like __wakeup() and __destruct() in the process. If the serialised payload is attacker-controlled, they can craft a Property Oriented Programming (POP) chain using classes already loaded in the application to achieve arbitrary code execution — a PHP Object Injection attack. Never call unserialize() on user-supplied input. Use JSON (json_encode/json_decode) for data exchange; if serialisation is required, use authenticated, signed payloads or a safe serialisation library.

Common Misconception

✗ serialize() is safe to use for caching any PHP object. serialize()/unserialize() on untrusted data triggers PHP object injection. For caching, use json_encode() for data structures or explicitly allowlist trusted classes via unserialize($data, ['allowed_classes' => [SpecificClass::class]]).

Why It Matters

serialize() converts PHP values to a storable string representation — passing serialized user input back to unserialize() is one of PHP's most dangerous patterns, enabling object injection attacks.

Common Mistakes

Unserializing any user-controlled data — cookies, URL parameters, database values from untrusted sources.
Using serialize() for data exchange between systems — use JSON instead; it cannot trigger PHP object instantiation.
Not using allowed_classes option in unserialize() to restrict which classes can be instantiated.
Storing serialized data in cookies — the cookie is user-controlled and can be replaced with a crafted payload.

Code Examples

✗ Vulnerable

$obj = unserialize($_COOKIE['data']); // attacker-controlled

✓ Fixed

$data = json_decode(base64_decode($_COOKIE['data']), true); // use JSON for simple data

Tags

Added 15 Mar 2026

Edited 22 Mar 2026

Curated in Warsaw under one editorial standard. 1,547 terms, single voice. About this reference →

Rate this term

No ratings yet

🤖 AI Guestbook educational data only

| |

Last 30 days

Agents 0

No pings yet today

No pings yesterday

Amazonbot 9 ChatGPT 9 PetalBot 8 Google 7 Ahrefs 7 SEMrush 7 Perplexity 6 Scrapy 5 Bing 5 Brave Search 5 Claude 4 Unknown AI 3 Applebot 3 Twitter/X 2 Sogou 2 Qwen 1 Meta AI 1

Also referenced

Insecure Deserialization 100 Eval Injection 89

How they use it

crawler 79 crawler_json 4 your_contextpost 1

Related categories

php 22.6k security 13.8k

🧱 FUNDAMENTALS — new to this? Start with the ground floor.

PHP php A server-side scripting language that generates web pages and APIs — the code runs on the server, and only its output (usually HTML or JSON) reaches the browser.

PHP is often the first server-side language people meet, and understanding its execution model — script starts fresh on every request, no memory between requests — explains most of how the web backend works: sessions, databases, and caching all exist to bridge that per-request amnesia.

💡 Start with PHP 8.x, declare(strict_types=1), and PDO — skip any tutorial that mentions mysql_query().

Ask Codex about PHP →

⚡ DEV INTEL Tools & Severity

🔴 Critical ⚙ Fix effort: Medium

⚡ Quick Fix

Replace serialize()/unserialize() with json_encode()/json_decode() for data persistence — JSON is safer (no object instantiation), human-readable, and language-agnostic

📦 Applies To

PHP 5.0+ web cli queue-worker

🔗 Prerequisites

Insecure Deserialization PHP Object Injection PHAR Deserialization Attack

🔍 Detection Hints

serialize() data stored in database or cookie; unserialize() of any user-controlled or untrusted data; session data serialised as PHP objects

Auto-detectable: ✓ Yes semgrep psalm phpstan

⚠ Related Problems

Insecure Deserialization PHP Object Injection PHAR Deserialization Attack

🤖 AI Agent

Confidence: Medium False Positives: Medium ✗ Manual fix Fix: High Context: File Tests: Update

CWE-502