Coding With Fun
Home Docker Django Node.js Articles Python pip guide FAQ Policy

PHP serialized/anti-serialized method functions


May 11, 2021 PHP


Table of contents


In the process of development, we often encounter situations where objects or arrays need to be stored serial numbers and the output is reserated. Especially when we need to store arrays in mysql databases, we often need to serialize them.

Serialization (serialization): the process of converting variables into strings that can be saved or transferred;

Anti-serialization (anti-serialization): This string is converted to the original variable in due course.

Together, these two processes make it easy to store and transfer data, making the program more maintainable.

Common php serialization and antiserialization methods are: serialize json_decode, unserialize json_encode;

Common usage

a. Object serialization Usage:

The object is stored in memory when it is created, destroyed at resolution time, and if the machine restarts, the object is destroyed in the new building. To save an object or pass it to another machine, you need to serialize (serialize) the object, or serialize when you need to store data in a database such as mysql.

Converting an object into a string is called serialization (serialization)

Converting strings into objects is called anti-serialization (anti-serialization)

b. Array serialization usage:

When transferring arrays across languages and devices, when storing a database or a nosql database, the data is transferred uniformly to the JavaScript object format because of the different data formats between the two.

1. Serialize and unserialize functions

These two are common functions for serializing and resericing data in PHP.

<?php
$a = array('a' => 'Apple' ,'b' => 'banana' , 'c' => 'Coconut');
 
//序列化数组
$s = serialize($a);
echo $s;
//输出结果:a:3:{s:1:"a";s:5:"Apple";s:1:"b";s:6:"banana";s:1:"c";s:7:"Coconut";}
echo '<br /><br />';

//反序列化
$o = unserialize($s);
print_r($o);
//输出结果 Array ( [a] => Apple [b] => banana [c] => Coconut )
?>
Problems can occur when array values contain characters such as double quotes, single quotes, or colons, which are reserated. To overcome this problem, a clever trick is to use base64_encode and base64_decode.
$obj = array();
//序列化
$s = base64_encode(serialize($obj)); 
//反序列化
$original = unserialize(base64_decode($s)); 
But base64 encoding will increase the length of the string. To overcome this problem, you can use it with gzcompress.
//定义一个用来序列化对象的函数
function my_serialize( $obj ) 
{ 
   return base64_encode(gzcompress(serialize($obj))); 
} 

//反序列化
function my_unserialize($txt) 
{ 
   return unserialize(gzuncompress(base64_decode($txt))); 
}

2. json_encode and json_decode

Serializing and antiseration using the JSON format is a good choice:

  • Using json_encode and json_decode format output is much faster than the Serialize and unserialize formats.
  • The JSON format is readable.
  • The JSON format returns smaller data results than the serialize return.
  • The JSON format is open and portable. It can also be used in other languages.
$a = array('a' => 'Apple' ,'b' => 'banana' , 'c' => 'Coconut');
 
//序列化数组
$s = json_encode($a);
echo $s;
//输出结果:{"a":"Apple","b":"banana","c":"Coconut"}

echo '<br /><br />';

//反序列化
$o = json_decode($s);

In the example above, the json_encode output length is obviously shorter than the serialize output length in the previous example.

3. var_export and eval

var_export function outputs the variable as a string; eval executes the string as PHP code, and the antiserration gets the contents of the original variable.

$a = array('a' => 'Apple' ,'b' => 'banana' , 'c' => 'Coconut');
//序列化数组
$s = var_export($a , true);
echo $s;
//输出结果: array ( 'a' => 'Apple', 'b' => 'banana', 'c' => 'Coconut', )
echo '<br /><br />';

//反序列化
eval('$my_var=' . $s . ';');

print_r($my_var);

4. wddx_serialize_value and wddx deserialize

wddx_serialize_value function can serialize array variables and output them as XML strings.

$a = array('a' => 'Apple' ,'b' => 'banana' , 'c' => 'Coconut');

//序列化数组
$s = wddx_serialize_value($a);
echo $s;

//输出结果(查看输出字符串的源码):<wddxPacket version='1.0'><header/><data><struct><var name='a'><string>Apple</string></var><var name='b'><string>banana</string></var><var name='c'><string>Coconut</string></var></struct></data></wddxPacket>

echo '<br /><br />';

//反序列化
$o = wddx_deserialize($s);

print_r($o);
//输出结果:Array ( [a] => Apple [b] => banana 1 => Coconut )

As you can see, XML tag characters are more, resulting in serialization of this format still take up a lot of space.

5.php anti-serialization tool

Test using the PHP antiserration tool

PHP serialized/anti-serialized method functions

Summary

All of the above functions perform normally when serializing array variables, but apply to objects differently. F or json_encode serialized object will fail. Unserialize and eval will have different effects when the object is reserialized.

If the multi-dimensional array for json_encode serialization may be false or unable to serialize the situation, this time you need to use some open source JSON processing libraries, such libraries are many on the Internet, when needed can be downloaded auxiliary use.