Object injection & deserialization security

When to use this skill

Use this skill whenever code touches PHP serialization:

• Calling unserialize(), maybe_unserialize(), or is_serialized() on user input.
• Storing serialized arrays/objects in options, post meta, user meta, or transients.
• Importing data from files, feeds, or uploads that may contain serialized PHP.
• Migrating or caching objects by serializing them.

PHP object injection lets an attacker instantiate arbitrary objects and trigger magic methods (__wakeup(), __destruct(), __toString()) that form POP (property-oriented programming) chains, often leading to remote code execution.

Core principles (and why they matter)