note 78895 added to function.assert-options

Beware of using assert for input validation. At least, be sure you have read and understood the documentation of assert(string). <?php // Warning: this code does not do what it looks like. $name = $_REQUEST["name"]; assert($name); // check that name is given print "Hello, " . htmlspecialchars($name) . "\n"; ?> The above code doesn't check that a name is given, but _evaluates_ the name. So when you send "system('id')" as your name in an HTTP request, the server will probably output something interesting. Instead, use the following code: <?php assert($name !== ""); ?> But beware of the string comparison operator. It sometimes also doesn't do what you would expect. ---- Server IP: 217.160.72.57 Probable Submitter: 213.39.206.178 ---- Manual Page -- http://www.php.net/manual/en/function.assert-options.php Edit -- https://master.php.net/note/edit/78895 Del: integrated -- https://master.php.net/note/delete/78895/integrated Del: useless -- https://master.php.net/note/delete/78895/useless Del: bad code -- https://master.php.net/note/delete/78895/bad+code Del: spam -- https://master.php.net/note/delete/78895/spam Del: non-english -- https://master.php.net/note/delete/78895/non-english Del: in docs -- https://master.php.net/note/delete/78895/in+docs Del: other reasons-- https://master.php.net/note/delete/78895 Reject -- https://master.php.net/note/reject/78895 Search -- https://master.php.net/manage/user-notes.php