Make WordPress Core

Opened 14 years ago

Closed 14 years ago

Last modified 14 years ago

#11391 closed defect (bug) (invalid)

logic error bug in php 5.3.0 probably needs attention in WP

Reported by: denis-de-bernardy's profile Denis-de-Bernardy Owned by:
Milestone: Priority: normal
Severity: major Version: 2.9
Component: General Keywords:
Focuses: Cc:


$foo = 0;
var_dump('foo' == $foo); // true
var_dump($foo == 'foo'); // true
var_dump('foo' === $foo); // false
var_dump($foo === 'foo'); // false

I encountered this obscure bug while looking into why memcached was returning false, when I definitely knew it contained 0. And, sure enough:

I haven't tested if it affected php 5.3.1 yet.

Change History (5)

#1 @Denis-de-Bernardy
14 years ago

It's actually a feature. :-(

That's a huge change in the way php handles strings/int comparison.

#2 @nacin
14 years ago

When was the change, in that case?

string(5) "5.2.9"

#3 in reply to: ↑ description @nacin
14 years ago

  • Resolution set to invalid
  • Status changed from new to closed

With emphasis added, the following is from This appears to be PHP in general, not a PHP 5.3 change.

String conversion to numbers

When a string is evaluated in a numeric context, the resulting value and type are determined as follows.

If the string does not contain any of the characters '.', 'e', or 'E' and the numeric value fits into integer type limits (as defined by PHP_INT_MAX), the string will be evaluated as an integer. In all other cases it will be evaluated as a float.

The value is given by the initial portion of the string. If the string starts with valid numeric data, this will be the value used. Otherwise, the value will be 0 (zero). Valid numeric data is an optional sign, followed by one or more digits (optionally containing a decimal point), followed by an optional exponent. The exponent is an 'e' or 'E' followed by one or more digits.

#4 @nacin
14 years ago

  • Milestone 2.9 deleted

#5 @Denis-de-Bernardy
14 years ago

Yeah, I read the same. It's weird, too. A numerical string is converted to a number before being compared:

var_dump(1 == '2'); // false
var_dump(1 == '1'); // true

At any rate, the issue generates a bug in Ryan's wp_object_cache class, mentioned further up.

I did a quick scan of the WP code and didn't spot any areas where this could potentially be abused (i.e. $user_submitted_int == 'something' leading to code execution that should not be), so I'll leave it there.

Note: See TracTickets for help on using tickets.