PHP serializes its sessions using the built-in serialize and unserialize methods
. serialize of PHP has the ability to serialize PHP objects (aka class instances
) and convert them to string. When you unserialize those strings, It converts
them back those same classes with those values. Classes who have some private
properties and want to encode/decode that or do something complex in their
serialization/deserialization implement the Serializable class and add
serialize and unserialize methods to the class.
When PHP's unserialize tries to unserialize a class object, but the class name
isn't declared/required, instead of giving a warning or throwing an Exception,
it converts it to an object of __PHP_Incomplete_Class.
If you don't want your session objects to convert to __PHP_Incomplete_Class,
You can do it by either requiring the class files before you invoke
session_start, or by registering an autoload function.