Although I agree there may be some security risks, object constructors are not called on unserialize. The primary reason being that constructors can have arguments, which the serializer would not know what to do with.

You’re right – trying again don’t know where I got that one from – one of those old assuptions I haven’t thougt about for a long time.

It’s the __wakeup function (if it exists) that get’s called when unserializing. Will do an update to the entry soon. In PHP5 you also have the destructor though, when the object goes out of scope or the script ends/

This is low risk but all the same, I personally don’t like the idea of unexpected code being executed and it costs almost nothing to protect yourself.

Good point on JSON also. At the same time, there’s only so much damage you can cause with a browser and eval() – main danger is probably session hijacking and similar. On a server there’s much more dangerous functionality around.