We were trying to insert serialized array data into a table, using the module.install update. We then noticed that we couldn't unserialize the data afterwards. After a little looking around, we realized that we cannot use the function "update_sql()" to insert the serialized data.

The problem is the pre-constructed SQL statement. When we use the function "udate_sql($sql)", we construct the SQL statement without using any argument. A serialized data normally contains curly brackets. When you call update_sql($sql), it then hands your pre-constructed $sql to the function db_query($sql). Inside the function db_query(), it replace the curly bracket with table prefix blindly, even the curly bracket inside data string are converted. And thus you will not be able to unserialize the data from the table anymore.

To get around this, instead of calling update_sql, call db_query($sql, $args). Put all the variables to be inserted into the table into the argument list. This way db_query will only convert the curly bracket surrounding the table name.