Beware of using addslashes() on input to the serialize() function. serialize() stores strings with their length; the length must match the stored string or unserialize() will fail.
Such a mismatch can occur if you serialize the result of addslashes() and store it in a database; some databases (definitely including PostgreSQL) automagically strip backslashes from "special" chars in SELECT results, causing the returned string to be shorter than it was when it was serialized.
In other words, do this...
<?php
$string="O'Reilly";
$ser=serialize($string); # safe -- won't count the slash
$result=addslashes($ser);
?>
...and not this...
<?php
$string="O'Reilly";
$add=addslashes($string); # RISKY! -- will count the slash
$result=serialize($add);
?>
In both cases, a backslash will be added after the apostrophe in "O'Reilly"; only in the second case will the backslash be included in the string length as recorded by serialize().
