In lot of cases, I have seen the wordpress stores data in JSON like structure but not exactly JSON.

For example, in usermeta table, this is the value (with meta key as wpkgbe_capabilities) a:1:{s:13:"administrator";s:1:"1";}

it seems as a JSON data structure but not exactly a JSON data structure. How do we decode this structure and what is it called?


That's not JSON, it's serialised PHP data. If you try to store a value that isn't a primitive string/number, such as an object or array, WordPress serializes it using PHP.

How do we decode this structure

deserialize( ... );

However, I do not recommend relying on this for practical and security reasons. Don't store structured data as strings in the database, and if you must do it, use JSON or CSV.

For data WP stores, you don't deserialize the data, but rather you call the relevant WordPress/plugin API and let WordPress/plugins handle it. Accessing WP data using direct database calls and bypassing the PHP based APIs is a common beginner mistake.

Security and Backwards Compatibility

Because passing complex data will get it serialized and deserialized transparently into PHP for ease of use, switching away to a standard format with fewer risks such as JSON is not a trivial task.

This is made worse by security issues, namely object deserialisation attacks. PHP will recreate objects when they're deserialised, running their constructors, and opening a potential attack vector.

There's also the corruption problem when a user naively performs an UPDATE sql query to change text values, such as search replacing a URL. This is because the serialized data structure contains the length of the value, so if the value changes length but the number is not updated then the structure is corrupted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.