# is_int/is_numeric possible bug

- Thread: https://externals.io/message/20837
- Original archive: https://news-web.php.net/php.internals/20837
- Started by Gareth Ardron on 2005-11-29T15:57:00+00:00
- Messages: 19
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #20837 — Gareth Ardron — 2005-11-29T15:57:00+00:00

URL: https://externals.io/message/20837#20837

Hi.

Think I've just stumbled upon a possible bug with is_int.

if you've got the following code:

<form action='1.php' method='post'>
<input type='text' name='days'>
<input type='submit' name='submit' value='submit'>
</form>
<?php
if (!is_int($_REQUEST['days']) || $_REQUEST['days'] < 0) {
        $_REQUEST['days'] = 10;
}
print "<br>days::".$_REQUEST['days'];
?>

and somebody enters, say "jkhdsjh" into the form, `is_int()` returns 1, 
thereby not setting the $_REQUEST['days'] variable to 10 - if I switch 
to using is_numeric then everything works as it should. Obviously, this 
isn't ideal as somebody could then enter 2.5 rather than the integers 
that I want to be passed.

Looking at the source, this is in ext/standard/type.c in the 
php_is_type() function which seems to be messing up.

Can anybody confirm this is:
a) undesired behaviour and I'm not just being very "special" and
b) that this is happening. I've tried on two boxes with 5.1.1[0] but 
it'd help to get somebody else's opinion

If it's a bug, I'll do a patch up later tonight - just want to get it 
confirmed first.

Cheers.

-- 
Gareth Ardron

[0] both debian/linux boxes. One i386, one x86_64.

---

## #20838 — Ron Korving — 2005-11-29T16:13:59+00:00

URL: https://externals.io/message/20837#20838 · In reply to: #20837

Just out of curiosity, to which versions does this apply?

Ron


"Gareth Ardron" <gareth@fission.org.uk> schreef in bericht 
news:438C7A4C.9090503@fission.org.uk...
> Hi.
>
> Think I've just stumbled upon a possible bug with is_int.
>
> if you've got the following code:
>
> <form action='1.php' method='post'>
> <input type='text' name='days'>
> <input type='submit' name='submit' value='submit'>
> </form>
> <?php
> if (!is_int($_REQUEST['days']) || $_REQUEST['days'] < 0) {
>        $_REQUEST['days'] = 10;
> }
> print "<br>days::".$_REQUEST['days'];
> ?>
>
> and somebody enters, say "jkhdsjh" into the form, `is_int()` returns 1, 
> thereby not setting the $_REQUEST['days'] variable to 10 - if I switch to 
> using is_numeric then everything works as it should. Obviously, this isn't 
> ideal as somebody could then enter 2.5 rather than the integers that I 
> want to be passed.
>
> Looking at the source, this is in ext/standard/type.c in the php_is_type() 
> function which seems to be messing up.
>
> Can anybody confirm this is:
> a) undesired behaviour and I'm not just being very "special" and
> b) that this is happening. I've tried on two boxes with 5.1.1[0] but it'd 
> help to get somebody else's opinion
>
> If it's a bug, I'll do a patch up later tonight - just want to get it 
> confirmed first.
>
> Cheers.
>
> -- 
> Gareth Ardron
>
> [0] both debian/linux boxes. One i386, one x86_64.

---

## #20842 — Florian Anderiasch — 2005-11-29T16:37:26+00:00

URL: https://externals.io/message/20837#20842 · In reply to: #20837

Gareth Ardron wrote:
> Hi.
> 
> Think I've just stumbled upon a possible bug with is_int.
Hello Gareth,
if I'm not mistaken, $_REQUEST['days'] is a string, and unless you use

if (!is_int(intval($_REQUEST['days'])) || $_REQUEST['days'] < 0) {

I see no problem in is_int taking a string with numerals inside as not int.

Greetings,
Florian

---

## #20843 — Antony Dovgal — 2005-11-29T16:43:41+00:00

URL: https://externals.io/message/20837#20843 · In reply to: #20837

./sapi/cli/php -r 'var_dump(is_int("jkhdsjh"));'
bool(false)

./sapi/cli/php -v
PHP 5.1.2-dev (cli)

What am I doing wrong?


> Hi.
> 
> Think I've just stumbled upon a possible bug with is_int.
> 
> if you've got the following code:
> 
> <form action='1.php' method='post'>
> <input type='text' name='days'>
> <input type='submit' name='submit' value='submit'>
> </form>
> <?php
> if (!is_int($_REQUEST['days']) || $_REQUEST['days'] < 0) {
>         $_REQUEST['days'] = 10;
> }
> print "<br>days::".$_REQUEST['days'];
> ?>
> 
> and somebody enters, say "jkhdsjh" into the form, `is_int()` returns 1, 
> thereby not setting the $_REQUEST['days'] variable to 10 - if I switch 
> to using is_numeric then everything works as it should. Obviously, this 
> isn't ideal as somebody could then enter 2.5 rather than the integers 
> that I want to be passed.
> 
> Looking at the source, this is in ext/standard/type.c in the 
> php_is_type() function which seems to be messing up.
> 
> Can anybody confirm this is:
> a) undesired behaviour and I'm not just being very "special" and
> b) that this is happening. I've tried on two boxes with 5.1.1[0] but 
> it'd help to get somebody else's opinion
> 
> If it's a bug, I'll do a patch up later tonight - just want to get it 
> confirmed first.
> 
> Cheers.
> 


-- 
Wbr, 
Antony Dovgal

---

## #20844 — Gareth Ardron — 2005-11-29T17:20:37+00:00

URL: https://externals.io/message/20837#20844 · In reply to: #20842

Florian Anderiasch wrote:
> Gareth Ardron wrote:
> 
> > […]
> 
> Hello Gareth,
> if I'm not mistaken, $_REQUEST['days'] is a string, and unless you use
> 
> if (!is_int(intval($_REQUEST['days'])) || $_REQUEST['days'] < 0) {
> 
> I see no problem in is_int taking a string with numerals inside as not int.

the problem with this (which I did try before posting) is that of course 
is somebody enters a text string, and you run `intval()` on that, it'll 
return 1, not 0 as it has content. Only if it's empty would it return 
zero, and as such `is_int()` will return 1/true again.

---

## #20845 — Gareth Ardron — 2005-11-29T17:21:11+00:00

URL: https://externals.io/message/20837#20845 · In reply to: #20838

Ron Korving wrote:
> Just out of curiosity, to which versions does this apply?

5.1.0b3->5.1.1 at least. Haven't got anything older to test on.

---

## #20846 — Antony Dovgal — 2005-11-29T17:26:44+00:00

URL: https://externals.io/message/20837#20846

> Antony Dovgal wrote:
> > […]
> 
> well that's interesting.
> 
> I think it's something to do with the way the var is passed - so could 
> even be a problem with the apache sapi.

I can hardly believe in that because the engine doesn't depend on the SAPI used.
Execute this code and see what you get.

> (I was using apache 1.3.33 
> (stock debian release) just so you know.)

And PHP from .deb too?
*That* could be a problem.

-- 
Wbr, 
Antony Dovgal

---

## #20848 — Matteo Beccati — 2005-11-29T17:36:44+00:00

URL: https://externals.io/message/20837#20848 · In reply to: #20845

Gareth Ardron wrote:
> Ron Korving wrote:
> > […]
> 
> 5.1.0b3->5.1.1 at least. Haven't got anything older to test on.

As far as I know request variables have always been strings, and 
 `is_int()` checks the variable type, not its content.

I wonder how your code was previously working ;)


For reference:
http://www.php.net/is_int


Best regards
--
Matteo Beccati
http://phpadsnew.com
http://phppgads.com

---

## #20847 — Gareth Ardron — 2005-11-29T17:37:18+00:00

URL: https://externals.io/message/20837#20847 · In reply to: #20846

Antony Dovgal wrote:

> 
> And PHP from .deb too?
> *That* could be a problem.
> 
God no, If I was doing that, I wouldn't report the bug here :)

Can give you the configure line if it'll help?

---

## #20849 — Gareth Ardron — 2005-11-29T17:42:10+00:00

URL: https://externals.io/message/20837#20849 · In reply to: #20848

Matteo Beccati wrote:
> Gareth Ardron wrote:
> 
> > […]
> 
> 
> As far as I know request variables have always been strings, and 
> `is_int()` checks the variable type, not its content.
> 
> I wonder how your code was previously working ;)

It wasn't, I was just helping a mate do something. New code.

But still, it seems very odd to me - I mean, why does `is_numeric()` 
therefore work when `is_int()` doesn't - that seems like strange logic to 
me (though I admit I'm not the most logical of people).

I just don't see the need to have to do:

if (is_numeric($_REQUEST['var']) && is_int($_REQUEST['var'])) {

when, at least in my mind, `is_int()` should do the job by itself.

---

## #20851 — Ben Litton — 2005-11-29T17:47:02+00:00

URL: https://externals.io/message/20837#20851 · In reply to: #20849

is_numeric will test if it's a numeric string. Maybe is_int should do the  
same, but apparently it doesn't.

You could always do an is_numeric and if it returns true, cast it as an  
int.

On Tue, 29 Nov 2005 12:42:10 -0500, Gareth Ardron <gareth@fission.org.uk>  
wrote:

> Matteo Beccati wrote:
> > […]
>
> It wasn't, I was just helping a mate do something. New code.
>
> But still, it seems very odd to me - I mean, why does `is_numeric()`  
> therefore work when `is_int()` doesn't - that seems like strange logic to  
> me (though I admit I'm not the most logical of people).
>
> I just don't see the need to have to do:
>
> if (is_numeric($_REQUEST['var']) && is_int($_REQUEST['var'])) {
>
> when, at least in my mind, `is_int()` should do the job by itself.



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

---

## #20852 — Matteo Beccati — 2005-11-29T17:50:52+00:00

URL: https://externals.io/message/20837#20852 · In reply to: #20851

Ben Litton wrote:
> is_numeric will test if it's a numeric string. Maybe is_int should do 
> the same, but apparently it doesn't.
> 
> You could always do an is_numeric and if it returns true, cast it as an 
> int.

Or use: www.php.net/ctype_digit


Ciao ciao
--
Matteo Beccati
http://phpadsnew.com
http://phppgads.com

---

## #20854 — Stefan Esser — 2005-11-29T17:51:45+00:00

URL: https://externals.io/message/20837#20854 · In reply to: #20849

Please move the discussion to php general mailinglist. This is a
usererror, a misunderstanding of is_int vs. is_numeric.

The documentation clearly states, that

is_numeric - Finds whether a variable is a number or a numeric string
is_int - Find whether a variable is an integer

anything within $_REQUEST is a string. Documentation clearly says that
is_int will return false, because a string is not an integer. is_numeric
will return true, because it is a numeric string.

Stefan

-- 
--------------------------------------------------------------------------
 Stefan Esser                                               sesser@php.net
 Hardened-PHP Project                         http://www.hardened-php.net/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0x15ABDA78
 Key fingerprint       7806 58C8 CFA8 CE4A 1C2C  57DD 4AE1 795E 15AB DA78

---

## #20853 — Sara Golemon — 2005-11-29T17:53:47+00:00

URL: https://externals.io/message/20837#20853 · In reply to: #20851

> is_numeric will test if it's a numeric string. Maybe is_int should do the 
> same, but apparently it doesn't.
>
What on earth for?
If you want content, do `is_numeric()`.  If you want type, do `is_int()`.... 
Simple.

-Sara

---

## #20856 — Ben Litton — 2005-11-29T17:57:01+00:00

URL: https://externals.io/message/20837#20856 · In reply to: #20853

> > […]
> What on earth for?
> If you want content, do `is_numeric()`.  If you want type, do `is_int()`....  
> Simple.
>
> -Sara

PHP lets you get away without worrying about types often enough that  
people slip up on this. I don't know if most PHP users care if the value  
of a variable is a "4" or a 4 but yes, it's easy enough to get around.



-- 
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

---

## #20855 — Gareth Ardron — 2005-11-29T17:57:41+00:00

URL: https://externals.io/message/20837#20855 · In reply to: #20854

Stefan Esser wrote:
> Please move the discussion to php general mailinglist. This is a
> usererror, a misunderstanding of is_int vs. is_numeric.
> 
My bad therefore, misunderstanding of the docs as you say.

Not sure I think it's entirely sane, but feh - it's been a long day, 
what do I know, etc etc.

Cheers to those who replied.

---

## #20857 — Bastian Grupe — 2005-11-29T17:59:25+00:00

URL: https://externals.io/message/20837#20857 · In reply to: #20851

Ben Litton wrote:
 >
 > You could always do an is_numeric and if it returns true, cast it as an
 > int.

That is the way it's meant to be done.
 `is_int()` really checks for the dataTYPE and not the CONTENTS (of course 
the contents depend on the type, e.g. in an int you won't find a string).

giving `is_numeric()` and the ctype functions strings as argument actually 
check for the CONTENTS (in different ways).

is_int(1) => true
is_int("1") => false

is_numeric(1) => true
is_numeric("1") => true


I hope now everything is clear for everybody.

Regards,
B. Grupe
P.S.: I think the general/help lists are more appropriate for these kind 
of problems before asking internals.
P.P.S.: Sorry for potential spam, but I thought it is necessary to clear 
it up once and for all.

---

## #20858 — Ron Korving — 2005-11-29T18:09:23+00:00

URL: https://externals.io/message/20837#20858 · In reply to: #20855

So when you said "and somebody enters, say "jkhdsjh" into the form, `is_int()`
returns 1" you were not really saying it as it was?

$var = "jkhdsjh";
is_int($var) should _not_ result in true. i figured you were talking about a
true bug here...

Ron


"Gareth Ardron" <gareth@fission.org.uk> wrote in message
news:438C9695.7030802@fission.org.uk...
> Stefan Esser wrote:
> > […]
> My bad therefore, misunderstanding of the docs as you say.
>
> Not sure I think it's entirely sane, but feh - it's been a long day,
> what do I know, etc etc.
>
> Cheers to those who replied.

---

## #20859 — Unknown W. Brackets — 2005-11-29T18:33:37+00:00

URL: https://externals.io/message/20837#20859 · In reply to: #20847

If you're having that problem that a request variable is being reported 
as an integer, I suggest using `var_dump()`.  That function will tell you 
the type and contents of a variable.  For example:

$bool = true;
$int = 1;
$float = 1.0;
$str = 'abc';
$array = array();

var_dump($bool, $int, $float, $str, $array);

Will give you:

bool(true)
int(1)
float(1)
string(3) "abc"
array(0) {
}

All of the above are very different.  A request variable should always 
be of type string, and if one is not then I suspect that may indeed be a 
bug.

Remember that PHP doesn't hide the type from you, it just simplifies 
conversions and usage for you.

In any case, if you want it to be 10 if it wasn't set to a valid int, I 
think you want:

$_REQUEST['days'] = is_numeric($_REQUEST['days']) ? (int) 
$_REQUEST['days'] : 10;

Or similar.  Note that this will treat "5.1" as 5, not as 10 (which may 
be what you want.)

-[Unknown]


-------- Original Message --------

> Antony Dovgal wrote:
> 
> > […]
> God no, If I was doing that, I wouldn't report the bug here :)
> 
> Can give you the configure line if it'll help?