Migrating PHP serialization from PHP 5.3 to PHP 5.6

Question

I have a complex structure that is saved in the MySQL database using the serialize() function and then converted back using unserialize(). After migrating the system from PHP 5.3 to PHP 5.6 and unserializing in 5.6 the the data that was serialized on 5.3, the structures are corrupted. Certain references to objects now appear as arrays instead.

My questions are:

1. Is there a specification about different encoding used by serialization/unserialization in the different PHP versions? (Could not find anything specific enough in my Google searches or in the documentation on PHP.net)

2. How do I convert serialized data from the PHP 5.3 encoding to the PHP 5.6 encoding?

Answer 1

Yes, the serialization of objects was changed in PHP5.6. Specifically a number of areas related to serialization of objects were tided up in PHP5.6

There is a vague note mentioning this in the PHP unserialize manual:

5.6.0 Manipulating the serialised data by replacing C: with O: to force object instantiation without calling the constructor will now fail.

However a look at the bugs list reveals a little more went on under the hood in report 68099. It also states that the original format has no official documentation:

"the original behavior (that we allow the old serialize format to be used for classes using the new format) was never documented nor officially supported,"

Note that the end result of that discussion was "Won't fix".

So basically, your options are:

• Try one of the other serializers as a way of exporting the data between PHP versions. Such as session_encode which can also handle objects.

• A conversion script. There is an extensively documented version of the current format on PHP internals, which you could use with an iterator on the old format to update the syntax.

Answer 2

You could convert the serialized data to JSON (using an installation of PHP 5.3), save that to the database and then do the opposit (using an installation of PHP 5.6).

From 5.3 to JSON :

$data = unserialize($strSerializedData);
$jsonData = json_encode($data);

From JSON to 5.6 :

$data = json_decode($jsonData);
$strSerializedData= serialize($data );

You might need to adjust the options you send to json_decode to match the original data.

This option would depend on what data is being serialized. If your data is classes, this wouldn't work.

Also, you problem could be related to this note in the documentation (here) :

5.6.0 Manipulating the serialised data by replacing C: with O: to force object instantiation without calling the constructor will now fail.