title: How can I unserialize basic types and arrays secure?
body: <p>I have to use unserialize with user-provided data in my project.
  IFAIK, using unserialize with untrusted data is unsecure due to possibility of execute user code via implicit call of wakeup-function and destructor ( <a href="https://wiki.php.net/rfc/secure_unserialize" rel="nofollow noreferrer">https://wiki.php.net/rfc/secure_unserialize</a> ).</p>
  
  <p>OK, I've tried smth like this</p>
  
  <pre><code>$a = serialize(array('a'=&gt;'b', 'c'=&gt;20));
  unserialize($a, array('allowed_classes'=&gt;false));
  </code></pre>
  
  <p>but unserialize ignores ALL data this way...</p>
  
  <p>So, the question is:
  how can I unserialize string contains the array(s) and basic datatypes (like ints, strings, bools and so on), but protect myself from unserialize the objects of undesired classes (and execute undesired code)?</p>
  
  <p>Thanks in advance.</p>