Bug #62633 [Nab]: strcasecmp does not warn user if both params are not strings

Edit report at https://bugs.php.net/bug.php?id=62633&edit=1 ID: 62633 Updated by: aharvey@php.net Reported by: iam4webwork at hotmail dot com Summary: strcasecmp does not warn user if both params are not strings Status: Not a bug Type: Bug Package: Scripting Engine problem PHP Version: Irrelevant Block user comment: N Private report: N New Comment: I think you've got it in one, really: the onus is on the developer. Weak typing doesn't have to be a mantra, but you have to pick a default behaviour in a language, and PHP defaults (generally) to its scalar being weakly typed and the onus being back on the developer to check inputs where it matters, rather than the strong typing onus on the developer of converting inputs. Previous Comments: ------------------------------------------------------------------------ [2012-07-23 17:19:41] iam4webwork at hotmail dot com If the PHP version of strcasecmp were to behave like the PHP version of strcmp in terms of handling a Boolean as input wouldn't that be more intelligent than allowing the C version of STRCASECMP to accept a parameter that is not terminated with a null string (see https://buildsecurityin.us-cert.gov/bsi- rules/home/g1/847-BSI.html re security issues: DOS)? Also, whereas weakly-typed is a design feature, it should not become a mantra in its own right. If a built-in function is expecting parameters of a certain type and an event occurs where the wrong parameters are provided shouldn't the user be alerted? Or, is the onus that of the programmer? ------------------------------------------------------------------------ [2012-07-23 01:08:46] aharvey@php.net PHP is a weakly typed language by design: if a scalar can be coerced into the type that a function expects, it will be. Expected behaviour → not a bug. ------------------------------------------------------------------------ [2012-07-22 21:23:23] iam4webwork at hotmail dot com I believe that somewhere the underlying C source code is converting the PHP TRUE, i.e. 1 to "1" ------------------------------------------------------------------------ [2012-07-22 21:19:42] iam4webwork at hotmail dot com Description: ------------ When I provide strcasecmp with two parameters where one is TRUE and the other is a string, php does not generate a warning to say that the first parameter needs to be a string and silently converts TRUE to "1" and executes. Test script: --------------- <?php var_dump(strcasecmp(TRUE, "bob")); // -49 Expected result: ---------------- I expected a parser error message. Actual result: -------------- -49 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62633&edit=1