Stack Overflow: Defend PHP - convince me it isn't horrible

Post by wvenable » Thu, Jul 15, 2010, 5:55 AM UTC

pilif wrote: post #61

wvenable wrote: post #50

Earlier quoted context omitted.

> What really disturbs me about PHP is its type conversion rules. 1 == '1' or even worse 'foobar' == 0, or '123n' == 123. This is cause for so many subtle bugs. Weird cases like 'foobar' == 0 are extremely rare and 1 == '1' is actually what you want most of the time. I've learned to embrace the type-less nature and use casts when I absolutely want to ensure a particular type. I no longer even consider this a problem.

The '123n'==123 conversion is the cause for at least 8 very nasty bugs in validating user input in that application I was referring to. And the fact that when comparing integer to strings, PHP prefers to convert the string to compare instead of converting the number (which would be lossless)

Post by wvenable » Thu, Jul 15, 2010, 6:50 AM UTC

pilif wrote: post #63

wvenable wrote: post #62

Earlier quoted context omitted.

If you care about numbers in your application, wouldn't the very first test in validating user input would be an is_numeric() call? In my opinion, you have to be doing a lot of other things incorrectly for this to be a real problem.

is_numeric doesn't help you if you want to find out whether the value in $foobar is a string that represents an integer or not. The only way to safely do that in PHP is, sadly, a regular expression. is_int checks the type, so is_int('1234') is as false as is_int('123n') or is_int('abc') is_numeric is too permissive as it allows floating point numbers or even hexadecimal values. intval($foobar) == $foobar doesn't work…

    function is_intval($value)
    {
	if (is_integer($value)) return true;
	if (is_bool($value)) return true;
	if (!is_numeric($value)) return false;
	if (is_float($value) && floatval(intval($value)) == $value) return true;
	if (is_string($value) && strval(intval($value)) == $value) return true;
	return false;
    }

Post by prodigal_erik » Thu, Jul 15, 2010, 9:23 AM UTC

wvenable wrote: post #50

pilif wrote: post #13

I'm spending most of my time maintaining a web application consisting of around 150k lines of PHP code. We (well - initially, it was just me) began development back in 2004 but since then the application has grown constantly. Back in 04, I already felt some reservations against PHP, but that's what I knew best and that's what was most used for the web (Rails might have been around, but not really known - other ruby o…

> What really disturbs me about PHP is its type conversion rules. 1 == '1' or even worse 'foobar' == 0, or '123n' == 123. This is cause for so many subtle bugs. Weird cases like 'foobar' == 0 are extremely rare and 1 == '1' is actually what you want most of the time. I've learned to embrace the type-less nature and use casts when I absolutely want to ensure a particular type. I no longer even consider this a problem.

  '0' == false
  array('0' => 'x') == array(false => 'x')
  ' 0' == true
  array(' 0' => 'x') != array(true => 'x')

Post by hackermom » Thu, Jul 15, 2010, 2:02 PM UTC

moell wrote: post #67

hackermom wrote: post #57

Earlier quoted context omitted.

PHP already does that via PDO. PHP's "Register globals" was deprecated exactly one year ago, in 5.3.0.

That was exactly chromatic's point---language design and features do make a difference.

Post by wvenable » Fri, Jul 16, 2010, 4:02 AM UTC

prodigal_erik wrote: post #66

wvenable wrote: post #50

Earlier quoted context omitted.

> What really disturbs me about PHP is its type conversion rules. 1 == '1' or even worse 'foobar' == 0, or '123n' == 123. This is cause for so many subtle bugs. Weird cases like 'foobar' == 0 are extremely rare and 1 == '1' is actually what you want most of the time. I've learned to embrace the type-less nature and use casts when I absolutely want to ensure a particular type. I no longer even consider this a problem.

You want '0' == 0 and ' 0' == 0. But you also get '0' == false array('0' => 'x') == array(false => 'x') ' 0' == true array(' 0' => 'x') != array(true => 'x') which isn't even an equivalence relation. I have to try this or look it up every time I run into it, because it doesn't make any damn sense.