# == and === - Thread: https://externals.io/message/16016 - Original archive: https://news-web.php.net/php.internals/16016 - Started by Hendy Irawan on 2005-04-18T18:46:01+00:00 - Messages: 6 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #16016 — Hendy Irawan — 2005-04-18T18:46:01+00:00 URL: https://externals.io/message/16016#16016 Just came across this: http://bugs.php.net/bug.php?id=23110 I've been programming PHP since PHP 3 and wasn't even aware of this behavior. "Numeric strings"? What is that? if ($typedPassword == $password) doSomeAdministrativeTaskHere(); You better not use '000000001' as password, or '0e00.0000', since people would be able to use '' (yes, empty string!) to hack your app. -- Hendy Irawan http://www.gauldong.net http://dev.gauldong.net --- ## #16020 — Sara Golemon — 2005-04-18T18:58:52+00:00 URL: https://externals.io/message/16016#16020 · In reply to: #16016 > Just came across this: > http://bugs.php.net/bug.php?id=23110 > > I've been programming PHP since PHP 3 > and wasn't even aware of this behavior. > And now you are. PHP is a loosely typed language. Odds are it's one of the things which attracted you to it in the first place. > "Numeric strings"? What is that? > Roughly speaking, a string matching the pattern: /^(-\d)?\d*(.[0-9]*)?(E[+-]\d+)?/ Though that's not precisely how the engine handles it internally. > if ($typedPassword == $password) doSomeAdministrativeTaskHere(); > > You better not use '000000001' as password, or '0e00.0000', since > people would be able to use '' (yes, empty string!) to hack your app. > Quick! Go change your password! --- ## #16021 — Hendy Irawan — 2005-04-18T19:28:58+00:00 URL: https://externals.io/message/16016#16021 · In reply to: #16020 > > […] > And now you are. > > PHP is a loosely typed language. Odds are it's one of the things which > attracted you to it in the first place. I can understand 0 == '' is true, but the string thingy is a bit surprising me. I thought === is only used when comparing different types, so it's used to strictly compare things of the same type as well? (as the case, strings, but objects come to mind as well) I guess === is a strict equality operator more than it is a type equality operator. > > […] > Roughly speaking, a string matching the pattern: > /^(-\d)?\d*(.[0-9]*)?(E[+-]\d+)?/ > Though that's not precisely how the engine handles it internally. > > > […] > Quick! Go change your password! 1 (nothing, false) 1 That confuses me more (but understandable, and thank God PHP behave this way)... I thought 'asdasd' is 0 when [implicitly] converted to int [for comparison]? I guess I never knew PHP well :-( -- Hendy Irawan http://www.gauldong.net http://dev.gauldong.net --- ## #16022 — Sara Golemon — 2005-04-18T19:51:17+00:00 URL: https://externals.io/message/16016#16022 · In reply to: #16021 > > 1 > > > (nothing, false) > > > 1 > > That confuses me more (but understandable, and thank God PHP behave > this way)... I thought 'asdasd' is 0 when [implicitly] converted to > int [for comparison]? I guess I never knew PHP well :-( > That would be the 'Roughly Speaking' and 'not precisely how the engine handles it internally' parts. In the case of string to string comparison there must be at least one digit involved at the start of the string (or a plus/minus sign followed by digits, etc...) in order to qualify as a numeric string. if (int && string) convert to int if (string && int) convert to int if (string && string && both strings start with numerics) convert both to int There's also float versions of those, but... you get the picture. -Sara --- ## #16024 — Hendy Irawan — 2005-04-18T20:05:18+00:00 URL: https://externals.io/message/16016#16024 · In reply to: #16022 > > […] > That would be the 'Roughly Speaking' and 'not precisely how the engine > handles it internally' parts. > > In the case of string to string comparison there must be at least one digit > involved at the start of the string (or a plus/minus sign followed by > digits, etc...) in order to qualify as a numeric string. I don't see this is the case: (false) (false) Isn't '0asdkoasdk' a numeric string? However: 1 (this is expected, although for the $password case, it can lead to security holes). More niceties: 1 1 (false) Programming in PHP can be a lot of fun! ;-) -- Hendy Irawan http://www.gauldong.net http://dev.gauldong.net --- ## #16025 — Andrey Hristov — 2005-04-18T20:11:36+00:00 URL: https://externals.io/message/16016#16025 · In reply to: #16024 Hi, don't forget that PHP was made for web programming and in this world you get from the user the input only as string therefore (nothing, false) > > […] 1 > > […] One more thing, consider creating a hash of the password and don't store the password in clear text. When the password is hashed, it is a string and you can compare it without any problems. Either you can use `sha1()`/md5() of PHP or let the RDBMS do the job if it provides MD5/SHA1 as functions. This way you are even not vulnerable to SQL injection coming from the password, but injection may come from the user name (you can hash it too ;) Regards, Andrey Hendy Irawan wrote: > > > > […] > > I don't see this is the case: > > > (false) > > > (false) > > Isn't '0asdkoasdk' a numeric string? > > However: > > > 1 > > (this is expected, although for the $password case, it can lead to > security holes). > More niceties: > > > 1 > > > 1 > > > (false) > > Programming in PHP can be a lot of fun! ;-)