Re: Security Issues - a bit of my experience

On Sunday 29 July 2001 19:42, Stephen van Egmond wrote: > will produce warnings if $x is not set. If you don't want the > warnings, you have to replace it with: > > if (isset($x) && $x) { > } > > "if it's set and it's true"...? ugh. > > One is then tempted to look for replacement functions in the > library, and immediately hits upon empty. > > if (!$empty) > > But as can be seen from the table at > http://bang.dhs.org/~svanegmond/logictest.php , empty() > returns TRUE if you hand it a boolean FALSE! Otherwise, the semantics > of empty() are a good replacement for the warning-generating cast to > boolean. I agree - to my mind empty is broken in this respect and also in the respect that it returns true for a string containing '0'. Consequently I (and I assume everyone else, unless I'm missing some occasion that this behaviour is useful) can never use empty in my code. Zeev was recently saying that he believed empty() was not as popular as isset() - and I suspect this is the reason. I think that empty() (for scalars) really should behave thus: function empty($var) { return !(isset($Var) && strcmp($var,'')); } as this is what needs to be done over and over again to validate form input. Maybe people really do use empty, so changing the behaviour will break loads of code. In which case an extra parameter $Useful, could be set to true to give useful behaviour :) -- Phil Driscoll