Update documentation and fix minor style issues.

README.md

@@ -4,18 +4,29 @@ Polyfill unserialize [![Build Status](https://travis-ci.org/dbrumann/polyfill-un
 Backports unserialize options introduced in PHP 7.0 to older PHP versions.
 This was originally designed as a Proof of Concept for Symfony Issue [#21090](https://github.com/symfony/symfony/pull/21090).
 
+You can use this package in projects that rely on PHP versions older than PHP 7.0.
+In case you are using PHP 7.0+ the original `unserialize()` will be used instead.
+
+From the [documentation](https://secure.php.net/manual/en/function.unserialize.php):
+
+> Warning: Do not pass untrusted user input to unserialize(). Unserialization can
+> result in code being loaded and executed due to object instantiation
+> and autoloading, and a malicious user may be able to exploit this.
+
+This warning holds true even when `allowed_classes` is used.
+
 Requirements
 ------------
 
- - PHP 5.3
+ - PHP 5.3+
 
 Installation
 ------------
 
 You can install this package via composer:
 
 ```
-composer require brumann/polyfill-unserialize
+composer require brumann/polyfill-unserialize "^1.0"
 ```
 
 Known Issues
@@ -44,5 +55,7 @@ phpunit -c phpunit.xml.dist tests/
 Contributing
 ------------
 
-This package is considered feature complete. Should you find any bugs or have
-questions, feel free to submit an Issue or a Pull Request.
+This package is considered feature complete. As such I will likely not update it
+unless there are security issues.
+
+Should you find any bugs or have questions, feel free to submit an Issue or a Pull Request.

src/Unserialize.php

@@ -17,7 +17,6 @@ public static function unserialize($serialized, array $options = array())
  if (PHP_VERSION_ID >= 70000) {
  return \unserialize($serialized, $options);
  }
-
  if (!array_key_exists('allowed_classes', $options)) {
  $options['allowed_classes'] = true;
  }
@@ -43,9 +42,8 @@ function ($matches) use ($allowedClasses) {
  } else {
  return sprintf(
  'O:22:"__PHP_Incomplete_Class":%d:{s:27:"__PHP_Incomplete_Class_Name";%s',
- $matches[2] + 1,
- // length of object + 1 for added string
- \serialize($matches[1])
+ $matches[2] + 1, // size of object + 1 for added string
+ \serialize($matches[1]) // original class name
  );
  }
  },