The tricky part
Rewriting inside a serialised string
A serialised PHP value carries the length of every string:
s:11:"shop.co.uk";. Replacing the text without fixing the length yields a
value unserialize() rejects — and the configuration concerned quietly disappears.
The module never calls unserialize(): waking up objects out of a copied database
would be an open door. It walks the string on the s:<n>:" pattern,
reads exactly the n declared bytes, applies the replacement to that
content alone, then writes the token back with the recomputed length. Quotes, semicolons and braces
sitting inside values therefore do not confuse the parse — which is precisely the case naive
replacements get wrong.
Detecting a serialised value is structural too, by regular expression: it executes nothing and does not depend on the content.