PHP unserialize fails with non-encoded characters?

The reason why unserialize() fails with:

$ser="a:2:{i:0;s:5:"héllö";i:1;s:5:"wörld";}";

Is because the length for héllö and wörld are wrong, since PHP doesn’t correctly handle multi-byte strings natively:

echo strlen('héllö'); // 7
echo strlen('wörld'); // 6

However if you try to unserialize() the following correct string:

$ser="a:2:{i:0;s:7:"héllö";i:1;s:6:"wörld";}";

echo '<pre>';
print_r(unserialize($ser));
echo '</pre>';

It works:

Array
(
    [0] => héllö
    [1] => wörld
)

If you use PHP serialize() it should correctly compute the lengths of multi-byte string indexes.

On the other hand, if you want to work with serialized data in multiple (programming) languages you should forget it and move to something like JSON, which is way more standardized.

Leave a Comment