{"record":{"id":"bf8c48ab730efab2","repo":"DesignPatternsPHP/DesignPatternsPHP","slug":"cannot-unserialize-singleton","errorCode":null,"errorMessage":"Cannot unserialize singleton","messagePattern":"Cannot unserialize singleton","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"Creational/Singleton/Singleton.php","lineNumber":45,"sourceCode":"     * to use the singleton, you have to obtain the instance from Singleton::getInstance() instead\n     */\n    private function __construct()\n    {\n    }\n\n    /**\n     * prevent the instance from being cloned (which would create a second instance of it)\n     */\n    private function __clone()\n    {\n    }\n\n    /**\n     * prevent from being unserialized (which would create a second instance of it)\n     */\n    public function __wakeup()\n    {\n        throw new Exception(\"Cannot unserialize singleton\");\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":48,"githubUrl":"https://github.com/DesignPatternsPHP/DesignPatternsPHP/blob/54254e0f2a59e27280f81304bce9218e12f97a03/Creational/Singleton/Singleton.php#L27-L48","documentation":"Singleton throws in __wakeup() to prevent unserialize() from creating a second instance, which would break the singleton guarantee. PHP's unserialization bypasses the constructor, so without this guard a clone would silently appear.","triggerScenarios":"Calling unserialize() on a serialized payload containing a Singleton object, e.g. data stored in sessions, caches, or cookies that captured a Singleton reference.","commonSituations":"Storing objects containing Singleton references in PHP sessions or serialize()-based caches and later unserializing them; legacy code that serialized whole object graphs.","solutions":["Do not include the Singleton in serialized data; serialize only plain data/IDs and re-fetch the instance via Singleton::get()","Use __serialize()/__sleep() on wrapper objects to drop the Singleton reference","If you truly need unserialize, ensure the payload never contains the Singleton class"],"exampleFix":"// before\n$data = unserialize($payload); // payload contains Singleton -> throws\n// after\n// store id only\n$payload = serialize(['id' => 123]);\n$data = unserialize($payload);\n$singleton = Singleton::get();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function containsSingleton(string $payload): bool {\n    return str_contains($payload, 'Singleton');\n}","tryCatchPattern":"try {\n    $data = unserialize($payload);\n} catch (Exception $e) {\n    $data = null; // payload contained a Singleton; rebuild via Singleton::get()\n}","preventionTips":["Never store Singleton references in sessions/caches; store plain data","Exclude the Singleton from serialized graphs via __sleep()/__serialize()","Re-obtain the instance via Singleton::get() after deserializing data"],"tags":["php","singleton-pattern","serialization"],"backgroundTag":"singleton-unserialize-blocked","analyzedSha":"54254e0f2a59e27280f81304bce9218e12f97a03","analyzedAt":"2026-09-01T06:00:26.376Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}