Serialization is the process of converting an object into a storageable or transferable format, while deserialization is the process of restoring it to an object. Implementing the Serializable interface in Java can use ObjectOutputStream and ObjectInputStream to operate. 1. The class must implement the Serializable interface; 2. All fields must be serializable or marked as transient; 3. It is recommended to manually define serialVersionUID to avoid version problems; 4. Use transient to eliminate sensitive fields; 5. Rewrite readObject/writeObject custom logic; 6. Pay attention to security, performance and compatibility issues, and use alternatives such as JSON when necessary. Mastering these key points can effectively improve the efficiency of Java serialization and deserialization.

Handling serialization and deserialization in Java is not complicated, but to really use it well, you have to pay attention to a lot of details. Java provides native support, but there are some common pitfalls that need attention.

What are serialization and deserialization?

Simply put, serialization is to turn objects into formats that can be stored or transferred, such as byte streams; while deserialization is to turn this process in reverse and reconstruct the original object.

In Java, you only need to make your class implement the Serializable interface, and you can use ObjectOutputStream and ObjectInputStream to perform serialization and deserialization operations.

How to do serialization correctly?

To make a class support serialization, the first step is to make it implement the Serializable interface:

 public class User implements Serializable {
    private String name;
    private int age;

    //Construction method, getter, setter, etc.}

Then you can write to the object like this:

 try (ObjectOutputStream out = new ObjectOutputStream(new FileOutputStream("user.ser"))) {
    User user = new User("Alice", 30);
    out.writeObject(user);
}

It's very similar when reading:

 try (ObjectInputStream in = new ObjectInputStream(new FileInputStream("user.ser"))) {
    User user = (User) in.readObject();
}

This may seem simple, but there are a few things to note:

• If the class does not implement Serializable , an exception will be thrown.
• All fields that need to be serialized must be serializable, otherwise they will either be marked as transient or they will implement Serializable themselves.
• It is recommended to manually define serialVersionUID , otherwise the default generated may fail to deserialize due to changes in the class structure.

Use transient keywords to control serialization of content

There are some fields you may not want to be saved, such as sensitive information or temporary cache. At this time, you can use the transient keyword to modify these fields:

 private transient String password;

After adding this keyword, the field will not be included in the automatic serialization mechanism.

If you also need to restore the values ??of these fields during deserialization, you can consider implementing the readObject method to customize the logic:

 private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
    in.defaultReadObject();
    password = "default"; // Custom recovery logic}

Of course, you can also rewrite writeObject to control the behavior during writing.

Some notes on serialization

Although the serialization mechanism of Java is very convenient, there are still several points that are easy to ignore in actual use:

• Version compatibility issues : If the structure of the class changes (such as adding or deserializing fields), the old data may not be deserialized normally. It is recommended to explicitly declare serialVersionUID .
• Security Issues : Deserializing untrusted data can lead to security risks, especially in cases of network transmission or user input.
• Performance issues : Java native serialization is not efficient, and other solutions are recommended for performance-sensitive scenarios, such as JSON or Protocol Buffers.

In addition, if you plan to transfer objects on the network or store objects in systems like Redis, you must also confirm whether they support Java native serialization, and often you will prefer to use common formats such as JSON.

Basically that's it. If you master these points, Java serialization and deserialization will be easy to use.

The above is the detailed content of How to handle serialization and deserialization in Java?. For more information, please follow other related articles on the PHP Chinese website!