Check to see if a string is serialized?

Question

What's the best way to determine whether or not a string is the result of the serialize() function?

https://www.php.net/manual/en/function.serialize

Answer 1

I'd say, try to unserialize it ;-)

Quoting the manual :

In case the passed string is not unserializeable, FALSE is returned and E_NOTICE is issued.

So, you have to check if the return value is false or not (with === or !==, to be sure not to have any problem with 0 or null or anything that equals to false, I'd say).

Just beware the notice : you might want/need to use the @ operator.

For instance :

$str = 'hjkl'; $data = @unserialize($str); if ($data !== false) {     echo "ok"; } else {     echo "not ok"; } 

Will get you :

not ok 

EDIT : Oh, and like @Peter said (thanks to him!), you might run into trouble if you are trying to unserialize the representation of a boolean false :-(

So, checking that your serialized string is not equal to "b:0;" might be helpful too ; something like this should do the trick, I suppose :

$data = @unserialize($str); if ($str === 'b:0;' || $data !== false) {     echo "ok"; } else {     echo "not ok"; } 

testing that special case before trying to unserialize would be an optimization -- but probably not that usefull, if you don't often have a false serialized value.

Answer 2

From WordPress core functions:

<?php function is_serialized( $data, $strict = true ) {     // If it isn't a string, it isn't serialized.     if ( ! is_string( $data ) ) {         return false;     }     $data = trim( $data );     if ( 'N;' === $data ) {         return true;     }     if ( strlen( $data ) < 4 ) {         return false;     }     if ( ':' !== $data[1] ) {         return false;     }     if ( $strict ) {         $lastc = substr( $data, -1 );         if ( ';' !== $lastc && '}' !== $lastc ) {             return false;         }     } else {         $semicolon = strpos( $data, ';' );         $brace     = strpos( $data, '}' );         // Either ; or } must exist.         if ( false === $semicolon && false === $brace ) {             return false;         }         // But neither must be in the first X characters.         if ( false !== $semicolon && $semicolon < 3 ) {             return false;         }         if ( false !== $brace && $brace < 4 ) {             return false;         }     }     $token = $data[0];     switch ( $token ) {         case 's':             if ( $strict ) {                 if ( '"' !== substr( $data, -2, 1 ) ) {                     return false;                 }             } elseif ( false === strpos( $data, '"' ) ) {                 return false;             }             // Or else fall through.         case 'a':         case 'O':             return (bool) preg_match( "/^{$token}:[0-9]+:/s", $data );         case 'b':         case 'i':         case 'd':             $end = $strict ? '$' : '';             return (bool) preg_match( "/^{$token}:[0-9.E+-]+;$end/", $data );     }     return false; }