The PHP Serializer converts JSON data into PHP’s native serialize format. This compact, type-preserving format is used by PHP for session storage, caching, and data persistence.
case 'php-serializer': { const val = parseJsonLoose(input); return { output: phpSerialize(val as PhpValue) };}
From lib/tools/php-tools.ts:99-127:
export function phpSerialize(value: PhpValue): string { if (value === null) return 'N;'; if (typeof value === 'boolean') return `b:${value ? 1 : 0};`; if (typeof value === 'number') { return Number.isInteger(value) ? `i:${value};` : `d:${value};`; } if (typeof value === 'string') { const byteLen = new TextEncoder().encode(value).length; return `s:${byteLen}:"${value}";`; } if (Array.isArray(value)) { const items = value.map((v, i) => `i:${i};${phpSerialize(v)}`).join(''); return `a:${value.length}:{${items}}`; } if (typeof value === 'object') { const entries = Object.entries(value); const items = entries .map(([k, v]) => { const key = /^\d+$/.test(k) ? `i:${parseInt(k)};` : `s:${new TextEncoder().encode(k).length}:"${k}";`; return key + phpSerialize(v); }) .join(''); return `a:${entries.length}:{${items}}`; } return 'N;';}
The serializer correctly handles UTF-8 multibyte characters by using byte length (not character count) for string serialization, ensuring compatibility with PHP’s native serialize() function.
For WordPress option/meta storage:
Convert your JSON data to PHP serialize format
Use update_option() or update_post_meta() with the serialized string
WordPress will store it directly without double-serialization
Never unserialize untrusted data in PHP (security risk: object injection attacks)
Serialized data is not human-readable; use PHP array syntax for config files
Format is PHP-specific; use JSON for cross-platform data exchange
Objects cannot be serialized (only arrays and primitives)