diff --git a/includes/actions.inc b/includes/actions.inc
index 5dce71e..07465a2 100644
--- a/includes/actions.inc
+++ b/includes/actions.inc
@@ -87,7 +87,7 @@ function actions_do($action_ids, $object = NULL, $context = NULL, $a1 = NULL, $a
       $query->condition('aid', $conditions, 'IN');
       $result = $query->execute();
       foreach ($result as $action) {
-        $actions[$action->aid] = $action->parameters ? unserialize($action->parameters) : array();
+        $actions[$action->aid] = $action->parameters ? drupal_json_decode($action->parameters) : array();
         $actions[$action->aid]['callback'] = $action->callback;
         $actions[$action->aid]['type'] = $action->type;
       }
@@ -119,7 +119,7 @@ function actions_do($action_ids, $object = NULL, $context = NULL, $a1 = NULL, $a
       $action = db_query("SELECT callback, parameters FROM {actions} WHERE aid = :aid", array(':aid' => $action_ids))->fetchObject();
       $function = $action->callback;
       if (function_exists($function)) {
-        $context = array_merge($context, unserialize($action->parameters));
+        $context = array_merge($context, drupal_json_decode($action->parameters));
         $actions_result[$action_ids] = $function($object, $context, $a1, $a2);
       }
       else {
@@ -347,7 +347,7 @@ function actions_save($function, $type, $params, $label, $aid = NULL) {
     ->fields(array(
       'callback' => $function,
       'type' => $type,
-      'parameters' => serialize($params),
+      'parameters' => drupal_json_encode($params),
       'label' => $label,
     ))
     ->execute();
diff --git a/includes/batch.inc b/includes/batch.inc
index 727c625..3eab555 100644
--- a/includes/batch.inc
+++ b/includes/batch.inc
@@ -30,7 +30,7 @@ function batch_load($id) {
     ':token' => drupal_get_token($id),
   ))->fetchField();
   if ($batch) {
-    return unserialize($batch);
+    return drupal_json_decode($batch);
   }
   return FALSE;
 }
@@ -526,7 +526,7 @@ function _batch_finished() {
 function _batch_shutdown() {
   if ($batch = batch_get()) {
     db_update('batch')
-      ->fields(array('batch' => serialize($batch)))
+      ->fields(array('batch' => drupal_json_encode($batch)))
       ->condition('bid', $batch['id'])
       ->execute();
   }
diff --git a/includes/batch.queue.inc b/includes/batch.queue.inc
index 8464836..9a3ed94 100644
--- a/includes/batch.queue.inc
+++ b/includes/batch.queue.inc
@@ -22,7 +22,7 @@ class BatchQueue extends SystemQueue {
   public function claimItem($lease_time = 0) {
     $item = db_query_range('SELECT data, item_id FROM {queue} q WHERE name = :name ORDER BY item_id ASC', 0, 1, array(':name' => $this->name))->fetchObject();
     if ($item) {
-      $item->data = unserialize($item->data);
+      $item->data = drupal_json_decode($item->data);
       return $item;
     }
     return FALSE;
@@ -37,7 +37,7 @@ class BatchQueue extends SystemQueue {
     $result = array();
     $items = db_query('SELECT data FROM {queue} q WHERE name = :name ORDER BY item_id ASC', array(':name' => $this->name))->fetchAll();
     foreach ($items as $item) {
-      $result[] = unserialize($item->data);
+      $result[] = drupal_json_decode($item->data);
     }
     return $result;
   }
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 18f44e2..c7b7d41 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -657,7 +657,7 @@ function variable_initialize($conf = array()) {
     }
     else {
       // Proceed with variable rebuild.
-      $variables = array_map('unserialize', db_query('SELECT name, value FROM {variable}')->fetchAllKeyed());
+      $variables = array_map("drupal_json_decode", db_query('SELECT name, value FROM {variable}')->fetchAllKeyed());
       cache_set('variables', $variables, 'cache_bootstrap');
       lock_release($name);
     }
@@ -713,7 +713,7 @@ function variable_get($name, $default = NULL) {
 function variable_set($name, $value) {
   global $conf;
 
-  db_merge('variable')->key(array('name' => $name))->fields(array('value' => serialize($value)))->execute();
+  db_merge('variable')->key(array('name' => $name))->fields(array('value' => drupal_json_encode($value)))->execute();
 
   cache_clear_all('variables', 'cache_bootstrap');
 
@@ -1119,7 +1119,7 @@ function bootstrap_hooks() {
  *   The attribute of $obj whose value should be unserialized.
  */
 function drupal_unpack($obj, $field = 'data') {
-  if ($obj->$field && $data = unserialize($obj->$field)) {
+  if ($obj->$field && $data = drupal_json_decode($obj->$field)) {
     foreach ($data as $key => $value) {
       if (!empty($key) && !isset($obj->$key)) {
         $obj->$key = $value;
diff --git a/includes/cache.inc b/includes/cache.inc
index 8666874..f4321e7 100644
--- a/includes/cache.inc
+++ b/includes/cache.inc
@@ -402,7 +402,7 @@ class DrupalDatabaseCache implements DrupalCacheInterface {
     }
 
     if ($cache->serialized) {
-      $cache->data = unserialize($cache->data);
+      $cache->data = drupal_json_decode($cache->data);
     }
 
     return $cache;
@@ -415,7 +415,7 @@ class DrupalDatabaseCache implements DrupalCacheInterface {
       'expire' => $expire,
     );
     if (!is_string($data)) {
-      $fields['data'] = serialize($data);
+      $fields['data'] = drupal_json_encode($data);
       $fields['serialized'] = 1;
     }
     else {
diff --git a/includes/common.inc b/includes/common.inc
index 8575844..f1e366f 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -3386,7 +3386,7 @@ function drupal_build_css_cache($css) {
   $data = '';
   $uri = '';
   $map = variable_get('drupal_css_cache_files', array());
-  $key = hash('sha256', serialize($css));
+  $key = hash('sha256', drupal_json_encode($css));
   if (isset($map[$key])) {
     $uri = $map[$key];
   }
@@ -4745,7 +4745,7 @@ function drupal_build_js_cache($files) {
   $contents = '';
   $uri = '';
   $map = variable_get('drupal_js_cache_files', array());
-  $key = hash('sha256', serialize($files));
+  $key = hash('sha256', drupal_json_encode($files));
   if (isset($map[$key])) {
     $uri = $map[$key];
   }
@@ -4802,8 +4802,7 @@ function drupal_clear_js_cache() {
  * @ingroup php_wrappers
  */
 function drupal_json_encode($var) {
-  // json_encode() does not escape <, > and &, so we do it with str_replace().
-  return str_replace(array('<', '>', '&'), array('\u003c', '\u003e', '\u0026'), json_encode($var));
+  return json_encode($var, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);
 }
 
 /**
@@ -4844,7 +4843,7 @@ function drupal_get_hash_salt() {
   global $drupal_hash_salt, $databases;
   // If the $drupal_hash_salt variable is empty, a hash of the serialized
   // database credentials is used as a fallback salt.
-  return empty($drupal_hash_salt) ? hash('sha256', serialize($databases)) : $drupal_hash_salt;
+  return empty($drupal_hash_salt) ? hash('sha256', drupal_json_encode($databases)) : $drupal_hash_salt;
 }
 
 /**
@@ -5924,7 +5923,7 @@ function drupal_render_collect_attached($elements, $return = FALSE) {
 function drupal_render_cache_by_query($query, $function, $expire = CACHE_TEMPORARY, $granularity = NULL) {
   $cache_keys = array_merge(array($function), drupal_render_cid_parts($granularity));
   $query->preExecute();
-  $cache_keys[] = hash('sha256', serialize(array((string) $query, $query->getArguments())));
+  $cache_keys[] = hash('sha256', drupal_json_encode(array((string) $query, $query->getArguments())));
   return array(
     '#query' => $query,
     '#pre_render' => array($function . '_pre_render'),
@@ -6691,7 +6690,7 @@ function drupal_get_schema_unprocessed($module, $table = NULL) {
  *   The module for which hook_schema() was invoked.
  * @param $remove_descriptions
  *   (optional) Whether to additionally remove 'description' keys of all tables
- *   and fields to improve performance of serialize() and unserialize().
+ *   and fields to improve performance of drupal_json_encode() and drupal_json_decode().
  *   Defaults to TRUE.
  */
 function _drupal_schema_initialize(&$schema, $module, $remove_descriptions = TRUE) {
@@ -6803,7 +6802,7 @@ function drupal_write_record($table, &$record, $primary_keys = array()) {
       $fields[$field] = $object->$field;
     }
     else {
-      $fields[$field] = serialize($object->$field);
+      $fields[$field] = drupal_json_encode($object->$field);
     }
 
     // Type cast to proper datatype, except when the value is NULL and the
diff --git a/includes/form.inc b/includes/form.inc
index 14cf618..16bcde8 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -4289,7 +4289,7 @@ function batch_process($redirect = NULL, $url = 'batch', $redirect_callback = 'd
           'bid' => $batch['id'],
           'timestamp' => REQUEST_TIME,
           'token' => drupal_get_token($batch['id']),
-          'batch' => serialize($batch),
+          'batch' => drupal_json_encode($batch),
         ))
         ->execute();
 
diff --git a/includes/install.core.inc b/includes/install.core.inc
index a74dfdf..65f14fa 100644
--- a/includes/install.core.inc
+++ b/includes/install.core.inc
@@ -779,7 +779,7 @@ function install_system_module(&$install_state) {
 function install_verify_completed_task() {
   try {
     if ($result = db_query("SELECT value FROM {variable} WHERE name = :name", array('name' => 'install_task'))) {
-      $task = unserialize($result->fetchField());
+      $task = drupal_json_decode($result->fetchField());
     }
   }
   // Do not trigger an error if the database query fails, since the database
diff --git a/includes/menu.inc b/includes/menu.inc
index 3a376f2..820cd09 100644
--- a/includes/menu.inc
+++ b/includes/menu.inc
@@ -375,7 +375,7 @@ function menu_get_ancestors($parts) {
  *   The unserialized $data array, with path arguments replaced.
  */
 function menu_unserialize($data, $map) {
-  if ($data = unserialize($data)) {
+  if ($data = drupal_json_decode($data)) {
     foreach ($data as $k => $v) {
       if (is_int($v)) {
         $data[$k] = isset($map[$v]) ? $map[$v] : '';
@@ -541,7 +541,7 @@ function _menu_load_objects(&$item, &$map) {
   if ($load_functions = $item['load_functions']) {
     // If someone calls this function twice, then unserialize will fail.
     if (!is_array($load_functions)) {
-      $load_functions = unserialize($load_functions);
+      $load_functions = drupal_json_decode($load_functions);
     }
     $path_map = $map;
     foreach ($load_functions as $index => $function) {
@@ -793,7 +793,7 @@ function _menu_translate(&$router_item, $map, $to_arg = FALSE) {
  *   An array of helper function (ex: array(2 => 'menu_tail_to_arg'))
  */
 function _menu_link_map_translate(&$map, $to_arg_functions) {
-  $to_arg_functions = unserialize($to_arg_functions);
+  $to_arg_functions = drupal_json_decode($to_arg_functions);
   foreach ($to_arg_functions as $index => $function) {
     // Translate place-holders into real values.
     $arg = $function(!empty($map[$index]) ? $map[$index] : '', $map, $index);
@@ -852,7 +852,7 @@ function menu_tail_load($arg, &$map, $index) {
  */
 function _menu_link_translate(&$item, $translate = FALSE) {
   if (!is_array($item['options'])) {
-    $item['options'] = unserialize($item['options']);
+    $item['options'] = drupal_json_decode($item['options']);
   }
   if ($item['external']) {
     $item['access'] = 1;
@@ -1313,7 +1313,7 @@ function _menu_build_tree($menu_name, array $parameters = array()) {
   if (isset($parameters['expanded'])) {
     sort($parameters['expanded']);
   }
-  $tree_cid = 'links:' . $menu_name . ':tree-data:' . $GLOBALS['language']->language . ':' . hash('sha256', serialize($parameters));
+  $tree_cid = 'links:' . $menu_name . ':tree-data:' . $GLOBALS['language']->language . ':' . hash('sha256', drupal_json_encode($parameters));
 
   // If we do not have this tree in the static cache, check {cache_menu}.
   if (!isset($trees[$tree_cid])) {
@@ -2802,7 +2802,7 @@ function menu_load_links($menu_name) {
     ->fetchAll();
 
   foreach ($links as &$link) {
-    $link['options'] = unserialize($link['options']);
+    $link['options'] = drupal_json_decode($link['options']);
   }
   return $links;
 }
@@ -2926,7 +2926,7 @@ function menu_link_save(&$item) {
   $existing_item = FALSE;
   if (isset($item['mlid'])) {
     if ($existing_item = db_query("SELECT * FROM {menu_links} WHERE mlid = :mlid", array(':mlid' => $item['mlid']))->fetchAssoc()) {
-      $existing_item['options'] = unserialize($existing_item['options']);
+      $existing_item['options'] = drupal_json_decode($existing_item['options']);
     }
   }
 
@@ -2955,7 +2955,7 @@ function menu_link_save(&$item) {
         'weight' => $item['weight'],
         'module' => $item['module'],
         'link_title' => $item['link_title'],
-        'options' => serialize($item['options']),
+        'options' => drupal_json_encode($item['options']),
         'customized' => $item['customized'],
         'updated' => $item['updated'],
       ))
@@ -3029,7 +3029,7 @@ function menu_link_save(&$item) {
         'p9' => $item['p9'],
         'module' => $item['module'],
         'link_title' => $item['link_title'],
-        'options' => serialize($item['options']),
+        'options' => drupal_json_encode($item['options']),
         'customized' => $item['customized'],
       ))
       ->condition('mlid', $item['mlid'])
@@ -3226,7 +3226,7 @@ function menu_link_maintain($module, $op, $link_path, $link_title) {
       $result = db_query("SELECT * FROM {menu_links} WHERE link_path = :link_path AND module = :module AND customized = 0", array(':link_path' => $link_path, ':module' => $module))->fetchAll(PDO::FETCH_ASSOC);
       foreach ($result as $link) {
         $link['link_title'] = $link_title;
-        $link['options'] = unserialize($link['options']);
+        $link['options'] = drupal_json_decode($link['options']);
         menu_link_save($link);
       }
       break;
@@ -3420,7 +3420,7 @@ function _menu_router_build($callbacks) {
     }
     $masks[$fit] = 1;
     $item['_load_functions'] = $load_functions;
-    $item['to_arg_functions'] = empty($to_arg_functions) ? '' : serialize($to_arg_functions);
+    $item['to_arg_functions'] = empty($to_arg_functions) ? '' : drupal_json_encode($to_arg_functions);
     $item += array(
       'title' => '',
       'weight' => 0,
@@ -3550,7 +3550,7 @@ function _menu_router_build($callbacks) {
       $item['access callback'] = intval($item['access callback']);
     }
 
-    $item['load_functions'] = empty($item['_load_functions']) ? '' : serialize($item['_load_functions']);
+    $item['load_functions'] = empty($item['_load_functions']) ? '' : drupal_json_encode($item['_load_functions']);
     $item += array(
       'access arguments' => array(),
       'access callback' => '',
@@ -3630,9 +3630,9 @@ function _menu_router_save($menu, $masks) {
       'load_functions' => $item['load_functions'],
       'to_arg_functions' => $item['to_arg_functions'],
       'access_callback' => $item['access callback'],
-      'access_arguments' => serialize($item['access arguments']),
+      'access_arguments' => drupal_json_encode($item['access arguments']),
       'page_callback' => $item['page callback'],
-      'page_arguments' => serialize($item['page arguments']),
+      'page_arguments' => drupal_json_encode($item['page arguments']),
       'delivery_callback' => $item['delivery callback'],
       'fit' => $item['_fit'],
       'number_parts' => $item['_number_parts'],
@@ -3641,9 +3641,9 @@ function _menu_router_save($menu, $masks) {
       'tab_root' => $item['tab_root'],
       'title' => $item['title'],
       'title_callback' => $item['title callback'],
-      'title_arguments' => ($item['title arguments'] ? serialize($item['title arguments']) : ''),
+      'title_arguments' => ($item['title arguments'] ? drupal_json_encode($item['title arguments']) : ''),
       'theme_callback' => $item['theme callback'],
-      'theme_arguments' => serialize($item['theme arguments']),
+      'theme_arguments' => drupal_json_encode($item['theme arguments']),
       'type' => $item['type'],
       'description' => $item['description'],
       'position' => $item['position'],
diff --git a/includes/module.inc b/includes/module.inc
index 23f2fa8..31ed9e6 100644
--- a/includes/module.inc
+++ b/includes/module.inc
@@ -164,7 +164,7 @@ function system_list($type) {
       // consistent with the one used in module_implements().
       $result = db_query("SELECT * FROM {system} WHERE type = 'theme' OR (type = 'module' AND status = 1) ORDER BY weight ASC, name ASC");
       foreach ($result as $record) {
-        $record->info = unserialize($record->info);
+        $record->info = drupal_json_decode($record->info);
         // Build a list of all enabled modules.
         if ($record->type == 'module') {
           $lists['module_enabled'][$record->name] = $record;
diff --git a/includes/registry.inc b/includes/registry.inc
index 3fb14fb..2ebfc75 100644
--- a/includes/registry.inc
+++ b/includes/registry.inc
@@ -38,7 +38,7 @@ function _registry_update() {
   // Get the list of files we are going to parse.
   $files = array();
   foreach ($modules as &$module) {
-    $module->info = unserialize($module->info);
+    $module->info = drupal_json_decode($module->info);
     $dir = dirname($module->filename);
 
     // Store the module directory for use in hook_registry_files_alter().
diff --git a/includes/session.inc b/includes/session.inc
index 2ede2ff..9b68981 100644
--- a/includes/session.inc
+++ b/includes/session.inc
@@ -104,7 +104,7 @@ function _drupal_session_read($sid) {
   // active user.
   if ($user && $user->uid > 0 && $user->status == 1) {
     // This is done to unserialize the data member of $user.
-    $user->data = unserialize($user->data);
+    $user->data = drupal_json_decode($user->data);
 
     // Add roles element to $user.
     $user->roles = array();
diff --git a/modules/book/book.module b/modules/book/book.module
index de9561f..317b79d 100644
--- a/modules/book/book.module
+++ b/modules/book/book.module
@@ -371,7 +371,7 @@ function book_get_books() {
       $result2 = $query->execute();
       foreach ($result2 as $link) {
         $link['href'] = $link['link_path'];
-        $link['options'] = unserialize($link['options']);
+        $link['options'] = drupal_json_decode($link['options']);
         $all_books[$link['bid']] = $link;
       }
     }
@@ -791,7 +791,7 @@ function book_node_load($nodes, $types) {
     $nodes[$record['nid']]->book = $record;
     $nodes[$record['nid']]->book['href'] = $record['link_path'];
     $nodes[$record['nid']]->book['title'] = $record['link_title'];
-    $nodes[$record['nid']]->book['options'] = unserialize($record['options']);
+    $nodes[$record['nid']]->book['options'] = drupal_json_decode($record['options']);
   }
 }
 
@@ -1292,7 +1292,7 @@ function book_menu_subtree_data($link) {
       $data['node_links'] = array();
       menu_tree_collect_node_links($data['tree'], $data['node_links']);
       // Compute the real cid for book subtree data.
-      $tree_cid = 'links:' . $item['menu_name'] . ':subtree-data:' . hash('sha256', serialize($data));
+      $tree_cid = 'links:' . $item['menu_name'] . ':subtree-data:' . hash('sha256', drupal_json_encode($data));
       // Cache the data, if it is not already in the cache.
 
       if (!cache_get($tree_cid, 'cache_menu')) {
diff --git a/modules/color/color.module b/modules/color/color.module
index 624575d..f1eca21 100644
--- a/modules/color/color.module
+++ b/modules/color/color.module
@@ -341,7 +341,7 @@ function color_scheme_form_submit($form, &$form_state) {
   }
 
   // Prepare target locations for generated files.
-  $id = $theme . '-' . substr(hash('sha256', serialize($palette) . microtime()), 0, 8);
+  $id = $theme . '-' . substr(hash('sha256', drupal_json_encode($palette) . microtime()), 0, 8);
   $paths['color'] = 'public://color';
   $paths['target'] = $paths['color'] . '/' . $id;
   foreach ($paths as $path) {
diff --git a/modules/comment/comment.test b/modules/comment/comment.test
index 82c6008..0577961 100644
--- a/modules/comment/comment.test
+++ b/modules/comment/comment.test
@@ -1809,7 +1809,7 @@ class CommentActionsTestCase extends CommentHelperCase {
    *   The assertion message.
    */
   function assertWatchdogMessage($watchdog_message, $variables, $message) {
-    $status = (bool) db_query_range("SELECT 1 FROM {watchdog} WHERE message = :message AND variables = :variables", 0, 1, array(':message' => $watchdog_message, ':variables' => serialize($variables)))->fetchField();
+    $status = (bool) db_query_range("SELECT 1 FROM {watchdog} WHERE message = :message AND variables = :variables", 0, 1, array(':message' => $watchdog_message, ':variables' => drupal_json_encode($variables)))->fetchField();
     return $this->assert($status, $message);
   }
 
diff --git a/modules/dblog/dblog.admin.inc b/modules/dblog/dblog.admin.inc
index 84ff4b8..9b3a55c 100644
--- a/modules/dblog/dblog.admin.inc
+++ b/modules/dblog/dblog.admin.inc
@@ -260,7 +260,7 @@ function theme_dblog_message($variables) {
     }
     // Message to translate with injected variables.
     else {
-      $output = t($event->message, unserialize($event->variables));
+      $output = t($event->message, drupal_json_decode($event->variables));
     }
     if ($variables['link'] && isset($event->wid)) {
       // Truncate message to 56 chars.
diff --git a/modules/dblog/dblog.module b/modules/dblog/dblog.module
index 496a043..8896916 100644
--- a/modules/dblog/dblog.module
+++ b/modules/dblog/dblog.module
@@ -146,7 +146,7 @@ function dblog_watchdog(array $log_entry) {
       'uid' => $user_uid,
       'type' => substr($log_entry['type'], 0, 64),
       'message' => $log_entry['message'],
-      'variables' => serialize($log_entry['variables']),
+      'variables' => drupal_json_encode($log_entry['variables']),
       'severity' => $log_entry['severity'],
       'link' => substr($log_entry['link'], 0, 255),
       'location' => $log_entry['request_uri'],
diff --git a/modules/dblog/dblog.test b/modules/dblog/dblog.test
index d2781eb..91eafce 100644
--- a/modules/dblog/dblog.test
+++ b/modules/dblog/dblog.test
@@ -61,7 +61,7 @@ class DBLogTestCase extends DrupalWebTestCase {
     $current_limit = variable_get('dblog_row_limit', 1000);
     $this->assertTrue($current_limit == $row_limit, t('[Cache] Row limit variable of @count equals row limit of @limit', array('@count' => $current_limit, '@limit' => $row_limit)));
     // Verify dblog row limit equals specified row limit.
-    $current_limit = unserialize(db_query("SELECT value FROM {variable} WHERE name = :dblog_limit", array(':dblog_limit' => 'dblog_row_limit'))->fetchField());
+    $current_limit = drupal_json_decode(db_query("SELECT value FROM {variable} WHERE name = :dblog_limit", array(':dblog_limit' => 'dblog_row_limit'))->fetchField());
     $this->assertTrue($current_limit == $row_limit, t('[Variable table] Row limit variable of @count equals row limit of @limit', array('@count' => $current_limit, '@limit' => $row_limit)));
   }
 
diff --git a/modules/field/field.crud.inc b/modules/field/field.crud.inc
index a6aaab1..1600682 100644
--- a/modules/field/field.crud.inc
+++ b/modules/field/field.crud.inc
@@ -348,7 +348,7 @@ function field_read_fields($params = array(), $include_additional = array()) {
   $fields = array();
   $results = $query->execute();
   foreach ($results as $record) {
-    $field = unserialize($record['data']);
+    $field = drupal_json_decode($record['data']);
     $field['id'] = $record['id'];
     $field['field_name'] = $record['field_name'];
     $field['type'] = $record['type'];
@@ -705,7 +705,7 @@ function field_read_instances($params = array(), $include_additional = array())
     // module exposing them was disabled).
     $entity_info = entity_get_info($record['entity_type']);
     if ($include_inactive || $entity_info) {
-      $instance = unserialize($record['data']);
+      $instance = drupal_json_decode($record['data']);
       $instance['id'] = $record['id'];
       $instance['field_id'] = $record['field_id'];
       $instance['field_name'] = $record['field_name'];
diff --git a/modules/field/field.install b/modules/field/field.install
index 16b09e1..5262023 100644
--- a/modules/field/field.install
+++ b/modules/field/field.install
@@ -223,7 +223,7 @@ function _update_7000_field_create_field(&$field) {
     'storage_module' => $field['storage']['module'],
     'storage_active' => (int) $field['storage']['active'],
     'locked' => (int) $field['locked'],
-    'data' => serialize($data),
+    'data' => drupal_json_encode($data),
     'cardinality' => $field['cardinality'],
     'translatable' => (int) $field['translatable'],
     'deleted' => (int) $field['deleted'],
@@ -325,7 +325,7 @@ function _update_7000_field_read_fields(array $conditions = array(), $key = 'id'
     $query->condition($column, $value);
   }
   foreach ($query->execute() as $record) {
-    $field = unserialize($record['data']);
+    $field = drupal_json_decode($record['data']);
     $field['id'] = $record['id'];
     $field['field_name'] = $record['field_name'];
     $field['type'] = $record['type'];
@@ -368,7 +368,7 @@ function _update_7000_field_create_instance($field, &$instance) {
     'field_name' => $instance['field_name'],
     'entity_type' => $instance['entity_type'],
     'bundle' => $instance['bundle'],
-    'data' => serialize($data),
+    'data' => drupal_json_encode($data),
     'deleted' => (int) $instance['deleted'],
   );
   $instance['id'] = db_insert('field_config_instance')
diff --git a/modules/field/tests/field.test b/modules/field/tests/field.test
index ebb1c9f..694e956 100644
--- a/modules/field/tests/field.test
+++ b/modules/field/tests/field.test
@@ -1134,10 +1134,10 @@ class FieldInfoTestCase extends FieldTestCase {
     // third-party module adding a new field setting has been enabled, and
     // existing fields do not know the setting yet).
     $data = db_query('SELECT data FROM {field_config} WHERE field_name = :field_name', array(':field_name' => $field_definition['field_name']))->fetchField();
-    $data = unserialize($data);
+    $data = drupal_json_decode($data);
     $data['settings'] = array();
     db_update('field_config')
-      ->fields(array('data' => serialize($data)))
+      ->fields(array('data' => drupal_json_encode($data)))
       ->condition('field_name', $field_definition['field_name'])
       ->execute();
 
@@ -1171,14 +1171,14 @@ class FieldInfoTestCase extends FieldTestCase {
     // third-party module adding instance, widget or display settings has been
     // enabled, but existing instances do not know the new settings).
     $data = db_query('SELECT data FROM {field_config_instance} WHERE field_name = :field_name AND bundle = :bundle', array(':field_name' => $instance_definition['field_name'], ':bundle' => $instance_definition['bundle']))->fetchField();
-    $data = unserialize($data);
+    $data = drupal_json_decode($data);
     $data['settings'] = array();
     $data['widget']['settings'] = 'unavailable_widget';
     $data['widget']['settings'] = array();
     $data['display']['default']['type'] = 'unavailable_formatter';
     $data['display']['default']['settings'] = array();
     db_update('field_config_instance')
-      ->fields(array('data' => serialize($data)))
+      ->fields(array('data' => drupal_json_encode($data)))
       ->condition('field_name', $instance_definition['field_name'])
       ->condition('bundle', $instance_definition['bundle'])
       ->execute();
@@ -1951,7 +1951,7 @@ class FieldCrudTestCase extends FieldTestCase {
     // Read the raw record from the {field_config_instance} table.
     $result = db_query('SELECT * FROM {field_config} WHERE field_name = :field_name', array(':field_name' => $field_definition['field_name']));
     $record = $result->fetchAssoc();
-    $record['data'] = unserialize($record['data']);
+    $record['data'] = drupal_json_decode($record['data']);
 
     // Ensure that basic properties are preserved.
     $this->assertEqual($record['field_name'], $field_definition['field_name'], t('The field name is properly saved.'));
@@ -2418,7 +2418,7 @@ class FieldInstanceCrudTestCase extends FieldTestCase {
     // Read the raw record from the {field_config_instance} table.
     $result = db_query('SELECT * FROM {field_config_instance} WHERE field_name = :field_name AND bundle = :bundle', array(':field_name' => $this->instance_definition['field_name'], ':bundle' => $this->instance_definition['bundle']));
     $record = $result->fetchAssoc();
-    $record['data'] = unserialize($record['data']);
+    $record['data'] = drupal_json_decode($record['data']);
 
     $field_type = field_info_field_types($this->field['type']);
     $widget_type = field_info_widget_types($field_type['default_widget']);
@@ -2706,7 +2706,7 @@ class FieldTranslationsTestCase extends FieldTestCase {
 
     $results = _field_invoke('test_op', $entity_type, $entity);
     foreach ($results as $langcode => $result) {
-      $hash = hash('sha256', serialize(array($entity_type, $entity, $this->field_name, $langcode, $values[$langcode])));
+      $hash = hash('sha256', drupal_json_encode(array($entity_type, $entity, $this->field_name, $langcode, $values[$langcode])));
       // Check whether the parameters passed to _field_invoke() were correctly
       // forwarded to the callback function.
       $this->assertEqual($hash, $result, t('The result for %language is correctly stored.', array('%language' => $langcode)));
@@ -2770,7 +2770,7 @@ class FieldTranslationsTestCase extends FieldTestCase {
     foreach ($grouped_results as $id => $results) {
       foreach ($results as $langcode => $result) {
         if (isset($values[$id][$langcode])) {
-          $hash = hash('sha256', serialize(array($entity_type, $entities[$id], $this->field_name, $langcode, $values[$id][$langcode])));
+          $hash = hash('sha256', drupal_json_encode(array($entity_type, $entities[$id], $this->field_name, $langcode, $values[$id][$langcode])));
           // Check whether the parameters passed to _field_invoke_multiple()
           // were correctly forwarded to the callback function.
           $this->assertEqual($hash, $result, t('The result for entity %id/%language is correctly stored.', array('%id' => $id, '%language' => $langcode)));
diff --git a/modules/field/tests/field_test.module b/modules/field/tests/field_test.module
index 4075296..db0565c 100644
--- a/modules/field/tests/field_test.module
+++ b/modules/field/tests/field_test.module
@@ -76,7 +76,7 @@ function field_test_menu() {
  * This simulates a field operation callback to be invoked by _field_invoke().
  */
 function field_test_field_test_op($entity_type, $entity, $field, $instance, $langcode, &$items) {
-  return array($langcode => hash('sha256', serialize(array($entity_type, $entity, $field['field_name'], $langcode, $items))));
+  return array($langcode => hash('sha256', drupal_json_encode(array($entity_type, $entity, $field['field_name'], $langcode, $items))));
 }
 
 /**
@@ -93,7 +93,7 @@ function field_test_field_test_op_multiple($entity_type, $entities, $field, $ins
     // by entity id. If they are grouped correctly, one entity, one instance and
     // one array of items should be available for each entity id.
     $field_name = $instances[$id]['field_name'];
-    $result[$id] = array($langcode => hash('sha256', serialize(array($entity_type, $entity, $field_name, $langcode, $items[$id]))));
+    $result[$id] = array($langcode => hash('sha256', drupal_json_encode(array($entity_type, $entity, $field_name, $langcode, $items[$id]))));
   }
   return $result;
 }
diff --git a/modules/filter/filter.module b/modules/filter/filter.module
index 773fa80..5ba0ff7 100644
--- a/modules/filter/filter.module
+++ b/modules/filter/filter.module
@@ -237,7 +237,7 @@ function filter_format_save($format) {
     $fields['weight'] = $format->filters[$name]['weight'];
     $fields['status'] = $format->filters[$name]['status'];
     $fields['module'] = $format->filters[$name]['module'];
-    $fields['settings'] = serialize($format->filters[$name]['settings']);
+    $fields['settings'] = drupal_json_encode($format->filters[$name]['settings']);
 
     db_merge('filter')
       ->key(array(
@@ -675,7 +675,7 @@ function filter_list_format($format_id) {
       if (isset($filter_info[$name])) {
         $filter->title = $filter_info[$name]['title'];
         // Unpack stored filter settings.
-        $filter->settings = (isset($filter->settings) ? unserialize($filter->settings) : array());
+        $filter->settings = (isset($filter->settings) ? drupal_json_decode($filter->settings) : array());
         // Merge in default settings.
         if (isset($filter_info[$name]['default settings'])) {
           $filter->settings += $filter_info[$name]['default settings'];
diff --git a/modules/help/help.test b/modules/help/help.test
index 73b4ded..0df83491 100644
--- a/modules/help/help.test
+++ b/modules/help/help.test
@@ -86,7 +86,7 @@ class HelpTestCase extends DrupalWebTestCase {
     $result = db_query("SELECT name, filename, info FROM {system} WHERE type = 'module' AND status = 1 ORDER BY weight ASC, filename ASC");
     foreach ($result as $module) {
       if (file_exists($module->filename) && function_exists($module->name . '_help')) {
-        $fullname = unserialize($module->info);
+        $fullname = drupal_json_decode($module->info);
         $this->modules[$module->name] = $fullname['name'];
       }
     }
diff --git a/modules/image/image.module b/modules/image/image.module
index 6ef43ad..3fcda93 100644
--- a/modules/image/image.module
+++ b/modules/image/image.module
@@ -1034,7 +1034,7 @@ function image_effects() {
       ->orderBy('image_effects.weight', 'ASC')
       ->execute();
     foreach ($result as $effect) {
-      $effect['data'] = unserialize($effect['data']);
+      $effect['data'] = drupal_json_decode($effect['data']);
       $definition = image_effect_definition_load($effect['name']);
       // Do not load image effects whose definition cannot be found.
       if ($definition) {
diff --git a/modules/menu/menu.test b/modules/menu/menu.test
index b457177..f5d8cf1 100644
--- a/modules/menu/menu.test
+++ b/modules/menu/menu.test
@@ -501,7 +501,7 @@ class MenuTestCase extends DrupalWebTestCase {
   function assertMenuLink($mlid, array $expected_item) {
     // Retrieve menu link.
     $item = db_query('SELECT * FROM {menu_links} WHERE mlid = :mlid', array(':mlid' => $mlid))->fetchAssoc();
-    $options = unserialize($item['options']);
+    $options = drupal_json_decode($item['options']);
     if (!empty($options['query'])) {
       $item['link_path'] .= '?' . drupal_http_build_query($options['query']);
     }
diff --git a/modules/profile/profile.module b/modules/profile/profile.module
index 2374fe8..ea5d5e0 100644
--- a/modules/profile/profile.module
+++ b/modules/profile/profile.module
@@ -254,7 +254,7 @@ function profile_user_load($users) {
   $result = db_query('SELECT f.name, f.type, v.uid, v.value FROM {profile_field} f INNER JOIN {profile_value} v ON f.fid = v.fid WHERE uid IN (:uids)', array(':uids' => array_keys($users)));
   foreach ($result as $record) {
     if (empty($users[$record->uid]->{$record->name})) {
-      $users[$record->uid]->{$record->name} = _profile_field_serialize($record->type) ? unserialize($record->value) : $record->value;
+      $users[$record->uid]->{$record->name} = _profile_field_serialize($record->type) ? drupal_json_decode($record->value) : $record->value;
     }
   }
 }
@@ -263,7 +263,7 @@ function profile_save_profile(&$edit, $account, $category, $register = FALSE) {
   $result = _profile_get_fields($category, $register);
   foreach ($result as $field) {
     if (_profile_field_serialize($field->type)) {
-      $edit[$field->name] = serialize($edit[$field->name]);
+      $edit[$field->name] = drupal_json_encode($edit[$field->name]);
     }
     db_merge('profile_value')
       ->key(array(
diff --git a/modules/rdf/rdf.module b/modules/rdf/rdf.module
index ebecd42..0c8e58f 100644
--- a/modules/rdf/rdf.module
+++ b/modules/rdf/rdf.module
@@ -200,7 +200,7 @@ function _rdf_mapping_load($type, $bundle) {
   if (!$mapping) {
     return array();
   }
-  return unserialize($mapping);
+  return drupal_json_decode($mapping);
 }
 
 /**
@@ -234,7 +234,7 @@ function rdf_mapping_save($mapping) {
       'bundle' => $mapping['bundle'],
     ))
     ->fields(array(
-      'mapping' => serialize($mapping['mapping']),
+      'mapping' => drupal_json_encode($mapping['mapping']),
     ))
     ->execute();
 
diff --git a/modules/rdf/rdf.test b/modules/rdf/rdf.test
index 9f786ab..f1a647d 100644
--- a/modules/rdf/rdf.test
+++ b/modules/rdf/rdf.test
@@ -249,7 +249,7 @@ class RdfCrudTestCase extends DrupalWebTestCase {
     // Read the raw record from the {rdf_mapping} table.
     $result = db_query('SELECT * FROM {rdf_mapping} WHERE type = :type AND bundle = :bundle', array(':type' => $mapping['type'], ':bundle' => $mapping['bundle']));
     $stored_mapping = $result->fetchAssoc();
-    $stored_mapping['mapping'] = unserialize($stored_mapping['mapping']);
+    $stored_mapping['mapping'] = drupal_json_decode($stored_mapping['mapping']);
     $this->assertEqual($mapping, $stored_mapping, t('Mapping was stored properly in the {rdf_mapping} table.'));
 
     // Verify loading of saved mapping.
@@ -264,7 +264,7 @@ class RdfCrudTestCase extends DrupalWebTestCase {
     // Read the raw record from the {rdf_mapping} table.
     $result = db_query('SELECT * FROM {rdf_mapping} WHERE type = :type AND bundle = :bundle', array(':type' => $mapping['type'], ':bundle' => $mapping['bundle']));
     $stored_mapping = $result->fetchAssoc();
-    $stored_mapping['mapping'] = unserialize($stored_mapping['mapping']);
+    $stored_mapping['mapping'] = drupal_json_decode($stored_mapping['mapping']);
     $this->assertEqual($mapping, $stored_mapping, t('Updated mapping was stored properly in the {rdf_mapping} table.'));
 
     // Verify loading of saved mapping.
diff --git a/modules/simpletest/drupal_web_test_case.php b/modules/simpletest/drupal_web_test_case.php
index 40af458..24a2fd9 100644
--- a/modules/simpletest/drupal_web_test_case.php
+++ b/modules/simpletest/drupal_web_test_case.php
@@ -1633,7 +1633,7 @@ class DrupalWebTestCase extends DrupalTestCase {
     // by DrupalWebTestCase::error().
     if (preg_match('/^X-Drupal-Assertion-[0-9]+: (.*)$/', $header, $matches)) {
       // Call DrupalWebTestCase::error() with the parameters from the header.
-      call_user_func_array(array(&$this, 'error'), unserialize(urldecode($matches[1])));
+      call_user_func_array(array(&$this, 'error'), drupal_json_decode(urldecode($matches[1])));
     }
 
     // Save cookies.
diff --git a/modules/simpletest/tests/database_test.test b/modules/simpletest/tests/database_test.test
index 143640d..de8480c 100644
--- a/modules/simpletest/tests/database_test.test
+++ b/modules/simpletest/tests/database_test.test
@@ -613,7 +613,7 @@ class DatabaseInsertLOBTestCase extends DatabaseTestCase {
       ->fields(array('blob1' => $data))
       ->execute();
     $r = db_query('SELECT * FROM {test_one_blob} WHERE id = :id', array(':id' => $id))->fetchAssoc();
-    $this->assertTrue($r['blob1'] === $data, t('Can insert a blob: id @id, @data.', array('@id' => $id, '@data' => serialize($r))));
+    $this->assertTrue($r['blob1'] === $data, t('Can insert a blob: id @id, @data.', array('@id' => $id, '@data' => drupal_json_encode($r))));
   }
 
   /**
@@ -968,7 +968,7 @@ class DatabaseUpdateLOBTestCase extends DatabaseTestCase {
       ->execute();
 
     $r = db_query('SELECT * FROM {test_one_blob} WHERE id = :id', array(':id' => $id))->fetchAssoc();
-    $this->assertTrue($r['blob1'] === $data, t('Can update a blob: id @id, @data.', array('@id' => $id, '@data' => serialize($r))));
+    $this->assertTrue($r['blob1'] === $data, t('Can update a blob: id @id, @data.', array('@id' => $id, '@data' => drupal_json_encode($r))));
   }
 
   /**
@@ -2916,7 +2916,7 @@ class DatabaseSerializeQueryTestCase extends DatabaseTestCase {
     $query->condition('name', 'Ringo');
     // If this doesn't work, it will throw an exception, so no need for an
     // assertion.
-    $query = unserialize(serialize($query));
+    $query = drupal_json_decode(serialize($query));
     $results = $query->execute()->fetchCol();
     $this->assertEqual($results[0], 28, t('Query properly executed after unserialization.'));
   }
diff --git a/modules/simpletest/tests/upgrade/upgrade.test b/modules/simpletest/tests/upgrade/upgrade.test
index 1ef8525..1e32608 100644
--- a/modules/simpletest/tests/upgrade/upgrade.test
+++ b/modules/simpletest/tests/upgrade/upgrade.test
@@ -199,7 +199,7 @@ abstract class UpgradePathTestCase extends DrupalWebTestCase {
     db_insert('variable')
       ->fields(array(
         'name' => $name,
-        'value' => serialize($value),
+        'value' => drupal_json_encode($value),
       ))
       ->execute();
 
diff --git a/modules/system/page.tpl.php b/modules/system/page.tpl.php
index bee1a2c..fee0c66 100644
--- a/modules/system/page.tpl.php
+++ b/modules/system/page.tpl.php
@@ -53,13 +53,13 @@
  *   comment/reply/12345).
  *
  * Regions:
- * - $page['help']: Dynamic help text, mostly for admin pages.
- * - $page['highlighted']: Items for the highlighted content region.
- * - $page['content']: The main content of the current page.
- * - $page['sidebar_first']: Items for the first sidebar.
- * - $page['sidebar_second']: Items for the second sidebar.
- * - $page['header']: Items for the header region.
- * - $page['footer']: Items for the footer region.
+ * - $page->help: Dynamic help text, mostly for admin pages.
+ * - $page->highlighted: Items for the highlighted content region.
+ * - $page->content: The main content of the current page.
+ * - $page->sidebar_first: Items for the first sidebar.
+ * - $page->sidebar_second: Items for the second sidebar.
+ * - $page->header: Items for the header region.
+ * - $page->footer: Items for the footer region.
  *
  * @see template_preprocess()
  * @see template_preprocess_page()
@@ -97,7 +97,7 @@
         </div> <!-- /#name-and-slogan -->
       <?php endif; ?>
 
-      <?php print render($page['header']); ?>
+      <?php print render($page->header); ?>
 
     </div></div> <!-- /.section, /#header -->
 
@@ -117,34 +117,34 @@
     <div id="main-wrapper"><div id="main" class="clearfix">
 
       <div id="content" class="column"><div class="section">
-        <?php if ($page['highlighted']): ?><div id="highlighted"><?php print render($page['highlighted']); ?></div><?php endif; ?>
+        <?php if ($page->highlighted): ?><div id="highlighted"><?php print render($page->highlighted); ?></div><?php endif; ?>
         <a id="main-content"></a>
         <?php print render($title_prefix); ?>
         <?php if ($title): ?><h1 class="title" id="page-title"><?php print $title; ?></h1><?php endif; ?>
         <?php print render($title_suffix); ?>
         <?php if ($tabs = render($tabs)): ?><div class="tabs"><?php print $tabs; ?></div><?php endif; ?>
-        <?php print render($page['help']); ?>
+        <?php print render($page->help); ?>
         <?php if ($action_links): ?><ul class="action-links"><?php print render($action_links); ?></ul><?php endif; ?>
-        <?php print render($page['content']); ?>
+        <?php print render($page->content); ?>
         <?php print $feed_icons; ?>
       </div></div> <!-- /.section, /#content -->
 
-      <?php if ($page['sidebar_first']): ?>
+      <?php if ($page->sidebar_first): ?>
         <div id="sidebar-first" class="column sidebar"><div class="section">
-          <?php print render($page['sidebar_first']); ?>
+          <?php print render($page->sidebar_first); ?>
         </div></div> <!-- /.section, /#sidebar-first -->
       <?php endif; ?>
 
-      <?php if ($page['sidebar_second']): ?>
+      <?php if ($page->sidebar_second): ?>
         <div id="sidebar-second" class="column sidebar"><div class="section">
-          <?php print render($page['sidebar_second']); ?>
+          <?php print render($page->sidebar_second); ?>
         </div></div> <!-- /.section, /#sidebar-second -->
       <?php endif; ?>
 
     </div></div> <!-- /#main, /#main-wrapper -->
 
     <div id="footer"><div class="section">
-      <?php print render($page['footer']); ?>
+      <?php print render($page->footer); ?>
     </div></div> <!-- /.section, /#footer -->
 
   </div></div> <!-- /#page, /#page-wrapper -->
diff --git a/modules/system/system.admin.inc b/modules/system/system.admin.inc
index 9e7d69d..f8742e8 100644
--- a/modules/system/system.admin.inc
+++ b/modules/system/system.admin.inc
@@ -2997,7 +2997,7 @@ function system_actions_configure($form, &$form_state, $action = NULL) {
     $edit['actions_type'] = $data->type;
     $function = $data->callback;
     $action = drupal_hash_base64($data->callback);
-    $params = unserialize($data->parameters);
+    $params = drupal_json_decode($data->parameters);
     if ($params) {
       foreach ($params as $name => $val) {
         $edit[$name] = $val;
diff --git a/modules/system/system.module b/modules/system/system.module
index 08bed29..c8f8e98 100644
--- a/modules/system/system.module
+++ b/modules/system/system.module
@@ -2212,7 +2212,7 @@ function system_update_files_database(&$files, $type) {
       $updated_fields = array();
 
       // Handle info specially, compare the serialized value.
-      $serialized_info = serialize($files[$file->name]->info);
+      $serialized_info = drupal_json_encode($files[$file->name]->info);
       if ($serialized_info != $file->info) {
         $updated_fields['info'] = $serialized_info;
       }
@@ -2263,7 +2263,7 @@ function system_update_files_database(&$files, $type) {
         'name' => $file->name,
         'type' => $type,
         'owner' => isset($file->owner) ? $file->owner : '',
-        'info' => serialize($file->info),
+        'info' => drupal_json_encode($file->info),
       ));
       $file->type = $type;
       $file->status = 0;
diff --git a/modules/system/system.queue.inc b/modules/system/system.queue.inc
index 00d3940..78db559 100644
--- a/modules/system/system.queue.inc
+++ b/modules/system/system.queue.inc
@@ -220,7 +220,7 @@ class SystemQueue implements DrupalReliableQueueInterface {
     $query = db_insert('queue')
       ->fields(array(
         'name' => $this->name,
-        'data' => serialize($data),
+        'data' => drupal_json_encode($data),
         // We cannot rely on REQUEST_TIME because many items might be created
         // by a single request which takes longer than 1 second.
         'created' => time(),
@@ -254,7 +254,7 @@ class SystemQueue implements DrupalReliableQueueInterface {
           ->condition('expire', 0);
         // If there are affected rows, this update succeeded.
         if ($update->execute()) {
-          $item->data = unserialize($item->data);
+          $item->data = drupal_json_decode($item->data);
           return $item;
         }
       }
diff --git a/modules/system/system.test b/modules/system/system.test
index 6a2c86e..9cb8ca1 100644
--- a/modules/system/system.test
+++ b/modules/system/system.test
@@ -116,7 +116,7 @@ class ModuleTestCase extends DrupalWebTestCase {
     $count = db_select('watchdog', 'w')
       ->condition('type', $type)
       ->condition('message', $message)
-      ->condition('variables', serialize($variables))
+      ->condition('variables', drupal_json_encode($variables))
       ->condition('severity', $severity)
       ->condition('link', $link)
       ->countQuery()
@@ -2015,7 +2015,7 @@ class SystemInfoAlterTestCase extends DrupalWebTestCase {
    */
   function getSystemInfo($name, $type) {
     $raw_info = db_query("SELECT info FROM {system} WHERE name = :name AND type = :type", array(':name' => $name, ':type' => $type))->fetchField();
-    return $raw_info ? unserialize($raw_info) : FALSE;
+    return $raw_info ? drupal_json_decode($raw_info) : FALSE;
   }
 }
 
diff --git a/modules/update/update.module b/modules/update/update.module
index a2d705a..f9433d0 100644
--- a/modules/update/update.module
+++ b/modules/update/update.module
@@ -750,7 +750,7 @@ function _update_cache_set($cid, $data, $expire) {
     'expire' => $expire,
   );
   if (!is_string($data)) {
-    $fields['data'] = serialize($data);
+    $fields['data'] = drupal_json_encode($data);
     $fields['serialized'] = 1;
   }
   else {
@@ -775,7 +775,7 @@ function _update_cache_get($cid) {
   $cache = db_query("SELECT data, created, expire, serialized FROM {cache_update} WHERE cid = :cid", array(':cid' => $cid))->fetchObject();
   if (isset($cache->data)) {
     if ($cache->serialized) {
-      $cache->data = unserialize($cache->data);
+      $cache->data = drupal_json_decode($cache->data);
     }
   }
   return $cache;
@@ -796,7 +796,7 @@ function _update_get_cache_multiple($cid_prefix) {
   foreach ($result as $cache) {
     if ($cache) {
       if ($cache->serialized) {
-        $cache->data = unserialize($cache->data);
+        $cache->data = drupal_json_decode($cache->data);
       }
       $data[$cache->cid] = $cache;
     }
diff --git a/modules/user/user.module b/modules/user/user.module
index ec00f79..1424f6d 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -300,7 +300,7 @@ class UserController extends DrupalDefaultEntityController {
     $picture_fids = array();
     foreach ($queried_users as $key => $record) {
       $picture_fids[] = $record->picture;
-      $queried_users[$key]->data = unserialize($record->data);
+      $queried_users[$key]->data = drupal_json_decode($record->data);
       $queried_users[$key]->roles = array();
       if ($record->uid) {
         $queried_users[$record->uid]->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
