Bug #77327 [Opn->Nab]: '0' == true, if on the right and stored as variable
Edit report at https://bugs.php.net/bug.php?id=77327&edit=1
ID: 77327
Updated by: nikic@php.net
Reported by: pegasus at vaultwiki dot org
Summary: '0' == true, if on the right and stored as variable
-Status: Open
+Status: Not a bug
Type: Bug
Package: *General Issues
Operating System: Centos 7
PHP Version: 7.2Git-2018-12-20 (Git)
Block user comment: N
Private report: N
New Comment:
Not a bug, per previous comment. Use || / && instead of or / and unless you are
*specifically* looking for the different precedence behavior.
Previous Comments:
------------------------------------------------------------------------
[2018-12-20 18:34:30] Wes dot example at example dot org
I'm not sure if there's more but the operator precedence is not what you think it is
$test = true AND '0';
is equal to
($test = true) AND '0';
not
$test = (true AND '0');
https://3v4l.org/cZF7G
------------------------------------------------------------------------
[2018-12-20 18:29:44] pegasus at vaultwiki dot org
Description:
------------
I recently noticed a behavior change in an application running on my web site where configuration
values in the application that were disabled were being treated like they were still enabled. The
application stores disabled values as '0' strings and relies on PHP's implicit
conversion (bool)'0' to false.
I have reduced the test cases and it seems to be related to whether there is a truthy value to the
left of the '0' in an AND expression, and the evaluation is being stored in a variable.
Depending on the way an application uses such an expression, this can have far-reaching implications
for security and the integrity of the application data.
Discovered on 7.2.11 (although I noticed the behavior for quite some versions before that), and
confirmed still occurring on Git branch 7.2 as of 12/20/18.
Test script:
---------------
// basic tests
var_dump(true AND '0'); // correctly returns false
$test = true AND '0';
var_dump($test); // returns true, should be false
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77327&edit=1
Thread (5 messages)