code: public static function deserialize($varValue, $blnForceArray=false)
  	{
  		// Already an array
  		if (\is_array($varValue))
  		{
  			return $varValue;
  		}
  
  		// Null
  		if ($varValue === null)
  		{
  			return $blnForceArray ? array() : null;
  		}
  
  		// Not a string
  		if (!\is_string($varValue))
  		{
  			return $blnForceArray ? array($varValue) : $varValue;
  		}
  
  		// Empty string
  		if (trim($varValue) == '')
  		{
  			return $blnForceArray ? array() : '';
  		}
  
  		// Not a serialized array (see #1486)
  		if (strncmp($varValue, 'a:', 2) !== 0)
  		{
  			return $blnForceArray ? array($varValue) : $varValue;
  		}
  
  		// Potentially including an object (see #6724)
  		if (preg_match('/[OoC]:\+?[0-9]+:"/', $varValue))
  		{
  			trigger_error('StringUtil::deserialize() does not allow serialized objects', E_USER_WARNING);
  
  			return $blnForceArray ? array($varValue) : $varValue;
  		}
  
  		$varUnserialized = @unserialize($varValue, array('allowed_classes' => false));
  
  		if (\is_array($varUnserialized))
  		{
  			$varValue = $varUnserialized;
  		}
  		elseif ($blnForceArray)
  		{
  			$varValue = array($varValue);
  		}
  
  		return $varValue;
  	}
docs: Return an unserialized array or the argument
  
  @param mixed   $varValue      The serialized string
  @param boolean $blnForceArray True to always return an array
  
  @return array|string|null The array, an empty string or null