Editing Serialization (section)

===PHP===
[[PHP]] originally implemented serialization through the built-in <code>serialize()</code> and <code>unserialize()</code> functions.<ref>{{cite web|url=http://ca.php.net/manual/en/language.oop5.serialization.php|title=PHP: Object Serialization - Manual|website=ca.php.net}}</ref> PHP can serialize any of its data types except resources (file pointers, sockets, etc.). The built-in <code>unserialize()</code> function is often dangerous when used on completely untrusted data.<ref>{{cite web|last=Esser|first=Stephen|title=Shocking News in PHP Exploitation|url=http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/|work=Suspekt...|date=2009-11-28|url-status=dead|archive-url=https://web.archive.org/web/20120106034257/http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/|archive-date=2012-01-06}}</ref> For objects, there are two "[[Magic (programming)|magic]] methods" that can be implemented within a class&nbsp;— <code>__sleep()</code> and <code>__wakeup()</code>&nbsp;— that are called from within <code>serialize()</code> and <code>unserialize()</code>, respectively, that can clean up and restore an object. For example, it may be desirable to close a database connection on serialization and restore the connection on deserialization; this functionality would be handled in these two magic methods. They also permit the object to pick which properties are serialized. Since PHP 5.1, there is an object-oriented serialization mechanism for objects, the <code>Serializable</code> interface.<ref name="Serializable">{{cite web|url=http://www.php.net/manual/en/class.serializable.php|title=PHP: Serializable - Manual|website=www.php.net}}</ref>