WordPress Option数据格式a:1:{s:12:"_multiwidget";i:1;}解析及PHP使用咨询

Hey there! Let's clear up the confusion around this format:

What Is This Format? #

This is PHP Serialization—a native PHP mechanism to convert complex data types (like arrays, objects) into a string that can be easily stored in databases or transferred between systems. WordPress relies heavily on this for storing option values, since the wp_options table stores most entries as plain text strings.

You mentioned thinking it was a special JSON format—while the structure looks vaguely similar, it’s fundamentally different. JSON uses syntax like {"key": value}, but PHP serialization includes type identifiers and length markers:

• a:1: = An array with 1 element
• s:12:"_multiwidget" = A string (s) with 12 characters, whose value is "_multiwidget"
• i:1 = An integer (i) with the value 1

That’s why json_decode() won’t work here—you need PHP’s serialization-specific functions instead.

How to Work With This Format in PHP #

1. Deserialize the String to Get Usable PHP Data #

Use the built-in unserialize() function to convert the serialized string back into a PHP array:

// Your serialized WordPress option string
$serialized_option = 'a:1:{s:12:"_multiwidget";i:1;}';

// Convert it to a PHP array
$decoded_data = unserialize($serialized_option);

// Now you can interact with the data like any other array
print_r($decoded_data);
// Output: Array ( [_multiwidget] => 1 )

2. Serialize PHP Data for WordPress Storage #

If you need to generate this format to store data in WordPress, you can use serialize() directly—but WordPress handles this automatically when you use its native option functions. For example:

// Your PHP array to store
$widget_data = ['_multiwidget' => 1];

// Use WordPress's update_option()—it takes care of serialization for you
update_option('your_widget_option', $widget_data);

// If you ever need to serialize manually (not recommended for WP options):
$serialized_data = serialize($widget_data);
// Result: a:1:{s:12:"_multiwidget";i:1;}

Important Security Note #

Be cautious when using unserialize() on data from untrusted sources. Maliciously crafted serialized strings can lead to code execution vulnerabilities. WordPress sanitizes data when using its own option functions, but if you’re handling raw serialized data externally, validate and sanitize it first.

内容的提问来源于stack exchange，提问作者user11533661