Are PHP objects supported?

No. Object and reference payloads are rejected before any class behavior could be represented.

Does this call PHP unserialize?

No. A bounded browser parser reads supported data tokens and no PHP runtime is involved.

PHP Serialize & Unserialize Tool – Safe Parser

What is PHP serialization?

PHP serialization is a byte-counted text format for scalar values, arrays, and objects. It differs from JSON in syntax, string length rules, references, and object metadata.

Why unserialize can be dangerous

Server-side object unserialization may load classes and trigger magic methods. This browser parser rejects object and reference tokens and supports only inert common data types.

Serialize vs JSON

JSON is language-neutral and broadly interoperable. PHP serialization is useful for compatibility with existing PHP data, but should not be accepted from untrusted sources by application code.

Frequently asked questions

Can object hooks run here?

No PHP runtime, autoloader, constructor, wakeup, or unserialize hook exists.

Are Unicode string lengths correct?

Yes. Serialized string lengths are calculated in UTF-8 bytes rather than JavaScript character units.