# Casting of objects to array exports private/protected data

- Thread: https://externals.io/message/7152
- Original archive: https://news-web.php.net/php.internals/7152
- Started by Andrey Hristov on 2004-01-17T15:44:29+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #7152 — Andrey Hristov — 2004-01-17T15:44:29+00:00

URL: https://externals.io/message/7152#7152

Hi internals,
casting an object to array gives the possibility to get the values of protected/private 
member variables :
<?php
class some {
         public $pub = 1;
         protected $prot = 2;
         private $priv = 3;

}
var_dump((array)new some());

?>
Produces :
array(3) {
   ["pub"]=>
   int(1)
   ["*prot"]=>
   int(2)
   ["somepriv"]=>
   int(3)
}

IMO, when casting to array with (array) only the public-ly visible members should returned.

Andrey

---

## #7153 — Pierre-Alain Joye — 2004-01-17T16:05:48+00:00

URL: https://externals.io/message/7152#7153 · In reply to: #7152

On Sat, 17 Jan 2004 16:44:29 +0100
Andrey Hristov <php@hristov.com> wrote:

> IMO, when casting to array with (array) only the public-ly visible
> members should returned.

Dunno, `E_STRICT` (as you can access them without notice/warning without
this flag)?

In the same manner:
<?php
error_reporting(E_STRICT);
class some {
         public $pub = 1;
         protected $prot = 2;
         private $priv = 3;

}
class any extends some {
        public $pub1 = 1;
        function `dump()` {
                var_dump($this);
        }
}
var_dump((array)new any());
$a = new any;
$a->dump();

?>

a var_dump should dump protected props from the parent class as they are
visible. Note the "funny" thing is that `var_dump()` alone do not display
the public|protected props, whatever is the context call. IMHO, that
sounds not very consistent, but only imho...

pierre

---

## #7154 — Andrey Hristov — 2004-01-17T16:07:31+00:00

URL: https://externals.io/message/7152#7154 · In reply to: #7153

Pierre-Alain Joye wrote:
> On Sat, 17 Jan 2004 16:44:29 +0100
> Andrey Hristov <php@hristov.com> wrote:
> 
> 
> > […]
> 
> 
> Dunno, `E_STRICT` (as you can access them without notice/warning without
> this flag)?
> 
> In the same manner:
> <?php
> error_reporting(E_STRICT);
> class some {
>          public $pub = 1;
>          protected $prot = 2;
>          private $priv = 3;
> 
> }
> class any extends some {
>         public $pub1 = 1;
>         function `dump()` {
>                 var_dump($this);
>         }
> }
> var_dump((array)new any());
> $a = new any;
> $a->dump();
> 
> ?>
> 
> a var_dump should dump protected props from the parent class as they are
> visible. Note the "funny" thing is that `var_dump()` alone do not display
> the public|protected props, whatever is the context call. IMHO, that
> sounds not very consistent, but only imho...
Yes, it does not. Use `print_r()` for dumping. `print_r()` uses internal zend function to dump 
the variable content while `var_dump()` is defined in ext/standard/var.c and knows nothing
about protected and private functions (or at least it was that 2 months ago).
 `print_r()` has the expected behavior of dumping data, but casting to array and getting 
protected/private data is nasty.


Andrey

---

## #7172 — Christian Schneider — 2004-01-18T22:42:35+00:00

URL: https://externals.io/message/7152#7172 · In reply to: #7152

Andrey Hristov wrote:
> casting an object to array gives the possibility to get the values of 
> protected/private member variables :
> 
> IMO, when casting to array with (array) only the public-ly visible 
> members should returned.

Public/protected/private is there to protect you from bugs due to name 
clashes when you extend classes. It is not a sandbox to protect you from 
'malicous' programmers.

And I like it that way: PINJ(Y) - PHP is not Java (yet)
Even though some people push it that way ;-)

- Chris