Structure of a Serialized PHP string

Question

I was wondering if anyone could point me to a resource where the details of a serialized php string is documented. I would basically like to know the format/structure so I can write a function in VB.NET to serialize/deserialize it back.

Thanks!

Answer 1

The basic structure is as follows:

Scalar types:

1. Booleans are serialized as:

   b:<i>; 

   where <i> is an integer with a value of either 0 (false) or 1 (true).

2. Integers are serialized as:

   i:<i>; 

   where <i> is the integer value.

3. Floats are serialized as (with d meaning double):

   d:<f>; 

   where <f> is the float value.

4. Strings are serialized as:

   s:<i>:"<s>"; 

   where <i> is an integer representing the string length of <s>, and <s> is the string value.

Special types:

1. null is simply serialized as:

   N; 

Compound types:

1. Arrays are serialized as:

   a:<i>:{<elements>} 

   where <i> is an integer representing the number of elements in the array, and <elements> zero or more serialized key value pairs:

   <key><value> 

   where <key> represents a serialized scalar type, and <value> any value that is serializable.

2. Objects are serialized as:

   O:<i>:"<s>":<i>:{<properties>} 

   where the first <i> is an integer representing the string length of <s>, and <s> is the fully qualified class name (class name prepended with full namespace). The second <i> is an integer representing the number of object properties. <properties> are zero or more serialized name value pairs:

   <name><value> 

   where <name> is a serialized string representing the property name, and <value> any value that is serializable.

   There's a catch with <name> though:

   <name> is represented as

   s:<i>:"<s>"; 

   where <i> is an integer representing the string length of <s>. But the values of <s> differs per visibility of properties:

   a. With public properties <s> is the simple name of the property.

   b. With protected properties, however, <s> is the simple name of the property, prepended with \0*\0 — an asterix, enclosed in two NUL characters (i.e. chr(0)).

   c. And with private properties, <s> is the simple name of the property, prepended with \0<s>\0 — <s>, enclosed in two NUL characters, where <s> is the fully qualified class name.

---

There are a few other cases, such as R:<i>;, that represents references, that I haven't mentioned here (because I honestly haven't figured out the exact workings of it yet), but this should give you a decent idea about PHP's serializing mechanism.

Answer 2

I've found this page at phpinternalsbook quite complete. It also shows the alternative serialization format for classes implementing Serializable interface, as well as the meaning of R format specifier.