161–170 of 185 posts
Earlier quoted context omitted.
Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.
What did you use for the important stuff that was 100% predictable?
Earlier quoted context omitted.
Ahh PHP, the language where true == false php > if ((true == "foo") && ("foo" == 0) && (0 == false)) echo "yay!"; yay!
I've never seen one, but somewhere there must surely be a PHP version of the infamous 'WAT' talk about JavaScript, full of examples like this and the "2d9"->"2e0"->3 example mentioned by lars.
Earlier quoted context omitted.
"This sort of thing happens in type conversion languages. You can either use === to stop conversion or you can understand how conversion works." Even JavaScript isn't insane enough to somehow coerce a string to 0.
Yes, JavaScript will convert strings into numbers console.log(5*"12"); 60 console.log(5*"0x0C"); 60
We use Java at the backend and of course Javascript for frontend. When serializing, in Java we should
String dataRaw = "42";
int objectId = Integer.parseInt(dataRaw);
dataRaw = "42";
var objectid = +dataRaw;I'm not exactly clear on how PHP == works, but you can see the MD5 for yourself: $ echo -n 240610708 | md5sum 0e462097431906509019562988736854 - $ echo -n QNKCDZO | md5sum 0e830400451993494058024219903391 - $ echo -n aabg7XSs | md5sum 0e087386482136013740957780965295 - All of them start with 0e, which makes me think that they're being parsed as floats and getting converted to 0.0. This is why "magic" operators like =…
Type coercion is fine so long as you recognize it as the syntactic sugar that it is. JS and PHP support easy type coercion because HTTP is string-only and it would be a pain in the ass to explicitly cast every value you get over the wire. You just have to be sure that, when you use it, you do so intentionally and not out of laziness.
It's pain in the ass to validate and sanitize your input.
Earlier quoted context omitted.
Once I wrote a little PHP application to manage a clan in a browser game. I used an MD5 hash as session id that I checked with if(session_id) When users started reporting that their logins would sometimes not work at the first time, I found out that strings that start with zero are coerced to 0 and then interpreted as false. Never used PHP for anything important since.
To be fair, this kind of thing (maybe not exactly this, but type-coercion bugs) can happen in JavaScript, which is all the rage now for "important" stuff.
$_1week = new DateInterval("P1W");
$_7days = new DateInterval("P7D");
var_dump($_1week == $_7days); // true
var_dump($_1week);
var_dump($_1week == $_7days); // false
var_dump($_7days);
var_dump($_1week == $_7days); // true
Same result with '$_1week = new DateInterval("P7D");' :-)
For security reason, I suggest PHP to implement such operators... :D Example:
"abc" === 'abc'; # ==> true
"abc" ==== 'abc'; # ==> false, single-quote vs double-quote
"abc" ===== 'abc'; # ==> true, this is how it works
j.k :D