Is php safe for e-commerce applications?
| From: | George Whiffen | Date: | Wed, 05 Dec 2001 20:05:11 +0000 |
| Subject: | Is php safe for e-commerce applications? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-76758@lists.php.net to get a copy of this message | ||
What a scary day, and it just gets worse....
1. A user finds their account balance is displayed incorrectly on one of my live e-commerce sites.
2. I discover that "floor()" intermittently gives the wrong answer i.e.
print floor(10*(8.20 - 0.20));
Answer : 79
print floor(10*(8.10 - 0.10));
Answer : 80
(php 4.0.6 and 4.0.4.pl1 under Linux 2.2.19.)
3. I find this is a known "feature" with no intention of ever being fixed. See
http://bugs.php.net/bug.php?id=6220
print floor( (0.7 + 0.1) * 10);
Answer : 7
4. I check the php documentation that was added because of that bug
(http://www.php.net/manual/en/language.types.float.php) and discover :-
"never trust floating number results to the last digit and never compare floating point
numbers
for equality."
5. I realise that the "last digit" might also be the first so that means never trust
anything except
integers!
6. The truth really sinks in... It seems I simply cannot use php for e-commerce applications unless
I convert all money to integers e.g. $4.32 must be handled as 432 cents, or all arithmetic
operations and comparisons have to be converted to use bc functions. Instead of :
if ($cost == 10.00)
you must write
if (bcomp($cost,10.00,2)) == 0)
etc.,etc.
7. The horror unfolds... php is just as full of geeko-trash as C/Perl/Java and the rest of them! I
will have to spend the rest of my life worrying about types/casts/floating point precision and all
that garbage even when I'm just adding up dollars and cents! I can't even escape to Italy
and work
in Lira, they're switching to euros with decimal places too! I should have stayed with Java,
it may
be rubbish but at least it's obviously rubbish!
Please someone, tell me I'm wrong!
Tell me that 0.1 + 0.7 can be 0.8 and not almost 0.8!
Tell me I don't have to check the last three years of work!
Tell me php isn't just for kids waiting to graduate/degradate to Java!
Tell me the techno-geeks haven't won!
Hellllllpppppppp......
George