Do not pass POST data to the `deserialize()` function (see #6695)

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.