Home » Php » Structure of a Serialized PHP string

Structure of a Serialized PHP string

Posted by: admin April 23, 2020 Leave a comment

Questions:

I was wondering if anyone could point me to a resource where the details of a serialized php string is documented. I would basically like to know the format/structure so I can write a function in VB.NET to serialize/deserialize it back.

Thanks!

How to&Answers:

The basic structure is as follows:

Scalar types:

  1. Booleans are serialized as:

    b:<i>;
    

    where <i> is an integer with a value of either 0 (false) or 1 (true).

  2. Integers are serialized as:

    i:<i>;
    

    where <i> is the integer value.

  3. Floats are serialized as (with d meaning double):

    d:<f>;
    

    where <f> is the float value.

  4. Strings are serialized as:

    s:<i>:"<s>";
    

    where <i> is an integer representing the string length of <s>, and <s> is the string value.

Special types:

  1. null is simply serialized as:

    N;
    

Compound types:

  1. Arrays are serialized as:

    a:<i>:{<elements>}
    

    where <i> is an integer representing the number of elements in the array, and <elements> zero or more serialized key value pairs:

    <key><value>
    

    where <key> represents a serialized scalar type, and <value> any value that is serializable.

  2. Objects are serialized as:

    O:<i>:"<s>":<i>:{<properties>}
    

    where the first <i> is an integer representing the string length of <s>, and <s> is the fully qualified class name (class name prepended with full namespace). The second <i> is an integer representing the number of object properties. <properties> are zero or more serialized name value pairs:

    <name><value>
    

    where <name> is a serialized string representing the property name, and <value> any value that is serializable.

    There’s a catch with <name> though:

    <name> is represented as

    s:<i>:"<s>";
    

    where <i> is an integer representing the string length of <s>. But the values of <s> differs per visibility of properties:

    a. With public properties <s> is the simple name of the property.

    b. With protected properties, however, <s> is the simple name of the property, prepended with \0*\0 — an asterix, enclosed in two NUL characters (i.e. chr(0)).

    c. And with private properties, <s> is the simple name of the property, prepended with \0<s>\0<s>, enclosed in two NUL characters, where <s> is the fully qualified class name.


There are a few other cases, such as R:<i>;, that represents references, that I haven’t mentioned here (because I honestly haven’t figured out the exact workings of it yet), but this should give you a decent idea about PHP’s serializing mechanism.

Answer:

I’ve found this page at phpinternalsbook quite complete. It also shows the alternative serialization format for classes implementing Serializable interface, as well as the meaning of R format specifier.