#30143 [Opn]: if () statement not parsing decimals fetched from mysql database correctly

ID: 30143 User updated by: tonglebeak at gmail dot com -Summary: if () statement not parsing decimals correctly Reported By: tonglebeak at gmail dot com Status: Open Bug Type: Unknown/Other Function Operating System: Linux PHP Version: 4.3.8 New Comment: Ok, I'm going to make a big edit here. It is only occurs when it's fetched from a database. I just realized the other way shows it as a string v_v. Here's an example of the security issue: <? //my file to connect to the database is here $row=mysql_fetch_row(mysql_query('SELECT score FROM games WHERE score=0 LIMIT 0,1')); /*Please note: the field for 'score' is a decimal type, and the data being fetched is 0.0000000000*/ if ($row[0]) echo 'true'; ?> And guess what: it echos 'true'; Previous Comments: ------------------------------------------------------------------------ [2004-09-18 18:56:13] tonglebeak at gmail dot com Description: ------------ Normally, whenever and int 0 is put into an if statement, the statement is returned as false. Same thing with double 0: it returns false. However, with a decimal, it's returning true. 0.0000000 is an example that is returning true. This can lead to possible security issues for those who rely on the if statement, and are using it on a decimal taken from a database for example for security checks and such. Reproduce code: --------------- <? $num='0.000000000'; if ($num) echo 'decimal true'; if ((int)$num) echo 'int true'; if ((double)$num) echo 'double true'; ?> Expected result: ---------------- I expect nothing to return true at all. Actual result: -------------- 'decimal true' is returned, meaning "if (0.000000000)" is returning true. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=30143&edit=1