serialize()/unserialize()
var_export()/eval()
A) security
You may feel it is dangerous to use eval().
Of course, you should not unserialize requested text.
However, you cannot use unserialize() for requested text also.
B) speed
A script for verification.
#!/usr/local/bin/(php-cli binaries)
<?php
function getmicrotime()
{
list($usec, $sec) = explode(" ",microtime());
return ((float)$sec + (float)$usec);
}
function var_import( $data ) {
eval( '$ret='.$data.';' ) ;
return $ret ;
}
$data = ( big array ) ;
$time_start = getmicrotime();
for( $i = 0 ; $i < $_SERVER['argv'][1] ; $i ++ ) {
$serialized_data = serialize( $data ) ;
$restored_data = unserialize( $serialized_data ) ;
$serialized_data = var_export( $data , true ) ;
$restored_data = var_import( $serialized_data ) ;
}
$time_end = getmicrotime() ;
echo $time_end - $time_start , "sec. \n" ;
?>