Comment by krapp

The takeway:

    You should never use user input on unserialize. Assuming that 
    using an up-to-date PHP version is enough to protect 
    unserialize in such scenarios is a bad idea. Avoid it or use 
    less complex serialization methods like JSON.