%s” returned as member variable from __sleep() but does not exist

Description

The magic method __sleep must return a list of properties of the current class. Any private property defined in the parent are excluded.

The returned array should be an array of strings, with the name of each property, without the initial $ sign.

Example

<?php

class X {
    public $p = 1;
    function __sleep() {
        return ['p', 'q', []];
    }
}

serialize(new X);

?>

Literal Examples

  • “q” returned as member variable from __sleep() but does not exist

  • “Array” returned as member variable from __sleep() but does not exist

Solutions

  • Remove all unknown properties.

  • Check the format of the property name, and remove the $ sign.

  • Check the visibility of the properties: private properties from parents are excluded.