title: Is serialize data dangerous with PDO
body: <p>I have <code>8 input type text. name=favour_01</code></p>
  
  <p>I make those 8 <code>input</code> into an <code>array</code> and <code>serialize</code> it</p>
  
  <p>i use <code>PDO</code> to save it into DB. </p>
  
  <p>Than unserialize it for output</p>
  
  <pre><code>$favour[]='apple'; $favour[]='banana';
  
  $favours = serialize($favours);
  
  prepare(...
  
  $food-&gt;bindValue(':favours', $favours, PDO::PARAM_STR);
  </code></pre>
  
  <p>is this secure? I have read serialize input is vulnerable.</p>
  
  <p>I didn't use any class for this, here is one post i have read <a href="https://www.owasp.org/index.php/PHP_Object_Injection" rel="nofollow">https://www.owasp.org/index.php/PHP_Object_Injection</a></p>