Do not process serialized objects in the `deserialize()` function (see #6695)

Do not process serialized objects in the `deserialize()` function, so it is not vulnerable to PHP object injection in conjunction with raw POST data. Thanks to Pedro Ribeiro for his input.
Remove redundant `deserialize()` calls
Correctly encode URLs with GET parameters in the syndication links (see #6683)