note 66245 deleted from language.operators.comparison by crell
| From: | crell@php.net | Date: | Thu, 31 Mar 2022 17:44:12 +0000 |
| Subject: | note 66245 deleted from language.operators.comparison by crell | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-217873@lists.php.net to get a copy of this message | ||
Note Submitter: Alex
----
I think everybody should read carefully what "jeronimo at DELETE_THIS dot transartmedia dot
com" wrote. It's a great pitfall even for seasoned programmers and should be looked upon
with a great attention.
For example, comparing passwords with == may result in a very large security hole.
I would add some more to it:
The workaround is to use strcmp() or ===.
Note on ===:
While the php documentation says that, basically,
($a===$b) is the same as ($a==$b && gettype($a) == gettype($b)),
this is not true.
The difference between == and === is that === never does any type conversion. So, while, according
to documentation, ("+0.1" === ".1") should return true (because both are strings
and == returns true), === actually returns false (which is good).