Sec Bug->Bug #82016 [Opn->Nab]: usage of +- in strtotime results in unexpected output with PHP8.2

Edit report at https://bugs.php.net/bug.php?id=82016&edit=1 ID: 82016 Updated by: derick@php.net Reported by: hallo at davidgreiner dot de Summary: usage of +- in strtotime results in unexpected output with PHP8.2 -Status: Open +Status: Not a bug -Type: Security +Type: Bug -Package: *General Issues +Package: Date/time related PHP Version: 8.2.8 Block user comment: N Private report: Y New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php This issue comes nowhere close to the requirements for this being classed as a security. As a matter of fact, this change is documented in the PHP 8.2 migration guide: https://www.php.net/manual/en/migration82.incompatible.php Previous Comments: ------------------------------------------------------------------------ [2023-07-27 08:26:54] hallo at davidgreiner dot de Description: ------------ Hello! In case of strtotime is used with '+- <date/time-string>' the output differs with PHP8.2 compared to PHP8.1 In my opionion - depending on the usage and codebase - this COULD be a security risk, thats why i am posting this here and not in the public bug tracker in github. Test script: --------------- <?php $foo = strtotime('+-2 hours'); $bar = strtotime('-2 hours'); echo '+-2 hours equals -2 hours = ' . ($foo === $bar ? 'yes' : 'no') . PHP_EOL; Expected result: ---------------- OUTPUT with PHP8.1: +-2 hours equals -2 hours = yes Actual result: -------------- OUTPUT with PHP8.2: +-2 hours equals -2 hours = no ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=82016&edit=1