mwx/serialized

metaworx handling of PHP-serialized data streams (stdin filter parsing serialized data without unserializing)

dev-master 2026-08-27 15:47 UTC

Requires

• php: ^8.2
• mwx/lib: ^0.1

MIT

• Martin Rüegg

Published on Packagist.org on 2026-08-27 18:25 UTC

README

Handling of PHP-serialized data streams. Owns the mwx\Serialized\ namespace prefix. MIT, self-contained.

• Parser — a structural parser for PHP-serialized data that never unserializes it: no object is instantiated, no __wakeup() or unserialize() handler runs. Parser::parseToObjectNotation() accepts a string or a stream resource (binary-safe) and returns a nested-array notation of the value; it covers the whole format (N;, b:, i:, d:, s:, a:, O:, C:, E:, R:/r: references). Malformed input throws ParseException; input that is merely a valid prefix of a payload throws the more specific IncompleteDataException, so streaming consumers can keep buffering.
• StdInFilter — a php_user_filter that validates PHP-serialized data flowing through stdin against the parser while passing it through (activate it via StdIO::activateInputFilter(StdInFilter::class)).
• Serializer — re-emits the parser's object notation as a PHP-serialized payload, recomputing all byte lengths from the actual bytes; modify string values in the notation and serialize back to a consistent payload.
• SearchAndReplace — serialization-aware search and replace over strings or database rows: string values inside serialized payloads are replaced structurally (keys, member names, class names untouched, nested payloads recursed) and re-emitted with corrected lengths; plain strings are replaced as-is. Perl-style regex search terms are auto-detected, and consumer-driven callbacks can unwrap/re-wrap values (e.g. base64 columns) around the run.

Install

Pre-publication: via the monorepo's path repository (see the repository root README). Later: composer require mwx/serialized.