Everything

php

is_int/is_numeric possible bug

php.internals

Gareth Ardron

20 years ago

Hi.

Think I've just stumbled upon a possible bug with is_int.

if you've got the following code:

<form action='1.php' method='post'>
<input type='text' name='days'>
<input type='submit' name='submit' value='submit'>
</form>
<?php
if (!is_int($_REQUEST['days']) || $_REQUEST['days'] < 0) {
$_REQUEST['days'] = 10;
}
print "<br>days::".$_REQUEST['days'];
?>

and somebody enters, say "jkhdsjh" into the form, is_int() returns 1,
thereby not setting the $_REQUEST['days'] variable to 10 - if I switch
to using is_numeric then everything works as it should. Obviously, this
isn't ideal as somebody could then enter 2.5 rather than the integers
that I want to be passed.

Looking at the source, this is in ext/standard/type.c in the
php_is_type() function which seems to be messing up.

Can anybody confirm this is:
a) undesired behaviour and I'm not just being very "special" and
b) that this is happening. I've tried on two boxes with 5.1.1[0] but
it'd help to get somebody else's opinion

If it's a bug, I'll do a patch up later tonight - just want to get it
confirmed first.

Cheers.

--
Gareth Ardron

[0] both debian/linux boxes. One i386, one x86_64.

Ron Korving

20 years ago

Just out of curiosity, to which versions does this apply?

Ron

"Gareth Ardron" <gareth@fission.org.uk> schreef in bericht
news:438C7A4C.9090503@fission.org.uk...

Gareth Ardron

20 years ago

Ron Korving wrote:

> Just out of curiosity, to which versions does this apply?

5.1.0b3->5.1.1 at least. Haven't got anything older to test on.

Matteo Beccati

20 years ago

Gareth Ardron wrote:

> Ron Korving wrote:
>> Just out of curiosity, to which versions does this apply?
>
> 5.1.0b3->5.1.1 at least. Haven't got anything older to test on.

As far as I know request variables have always been strings, and
is_int() checks the variable type, not its content.

I wonder how your code was previously working ;)

For reference:
http://www.php.net/is_int

Best regards

--
Matteo Beccati
http://phpadsnew.com
http://phppgads.com

Gareth Ardron

20 years ago

Matteo Beccati wrote:

> Gareth Ardron wrote:
>
>> Ron Korving wrote:
>>
>>> Just out of curiosity, to which versions does this apply?
>>
>>
>> 5.1.0b3->5.1.1 at least. Haven't got anything older to test on.
>
>
> As far as I know request variables have always been strings, and
> is_int() checks the variable type, not its content.
>
> I wonder how your code was previously working ;)

It wasn't, I was just helping a mate do something. New code.

But still, it seems very odd to me - I mean, why does is_numeric()
therefore work when is_int() doesn't - that seems like strange logic to
me (though I admit I'm not the most logical of people).

I just don't see the need to have to do:

if (is_numeric($_REQUEST['var']) && is_int($_REQUEST['var'])) {

when, at least in my mind, is_int() should do the job by itself.

Ben Litton

20 years ago

is_numeric will test if it's a numeric string. Maybe is_int should do the
same, but apparently it doesn't.

You could always do an is_numeric and if it returns true, cast it as an
int.

On Tue, 29 Nov 2005 12:42:10 -0500, Gareth Ardron <gareth@fission.org.uk>
wrote:

> Matteo Beccati wrote:
>> Gareth Ardron wrote:
>>
>>> Ron Korving wrote:
>>>
>>>> Just out of curiosity, to which versions does this apply?
>>>
>>>
>>> 5.1.0b3->5.1.1 at least. Haven't got anything older to test on.
>>   As far as I know request variables have always been strings, and
>> is_int() checks the variable type, not its content.
>>  I wonder how your code was previously working ;)
>
> It wasn't, I was just helping a mate do something. New code.
>
> But still, it seems very odd to me - I mean, why does is_numeric()
> therefore work when is_int() doesn't - that seems like strange logic to
> me (though I admit I'm not the most logical of people).
>
> I just don't see the need to have to do:
>
> if (is_numeric($_REQUEST['var']) && is_int($_REQUEST['var'])) {
>
> when, at least in my mind, is_int() should do the job by itself.

--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

Matteo Beccati

20 years ago

Ben Litton wrote:

> is_numeric will test if it's a numeric string. Maybe is_int should do
> the same, but apparently it doesn't.
>
> You could always do an is_numeric and if it returns true, cast it as an
> int.

Or use: www.php.net/ctype_digit

Ciao ciao

--
Matteo Beccati
http://phpadsnew.com
http://phppgads.com

Sara Golemon

20 years ago

> is_numeric will test if it's a numeric string. Maybe is_int should do the
> same, but apparently it doesn't.
>

What on earth for?
If you want content, do is_numeric().  If you want type, do is_int()....
Simple.

-Sara

Ben Litton

20 years ago

On Tue, 29 Nov 2005 12:53:47 -0500, "Sara Golemon" <pollita@php.net> wrote:

>> is_numeric will test if it's a numeric string. Maybe is_int should do
>> the same, but apparently it doesn't.
>>
> What on earth for?
> If you want content, do is_numeric().  If you want type, do is_int()....
> Simple.
>
> -Sara

PHP lets you get away without worrying about types often enough that
people slip up on this. I don't know if most PHP users care if the value
of a variable is a "4" or a 4 but yes, it's easy enough to get around.

--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

Bastian Grupe

20 years ago

Ben Litton wrote:

>
> You could always do an is_numeric and if it returns true, cast it as an
> int.

That is the way it's meant to be done.
is_int() really checks for the dataTYPE and not the CONTENTS (of course
the contents depend on the type, e.g. in an int you won't find a string).

giving is_numeric() and the ctype functions strings as argument actually
check for the CONTENTS (in different ways).

is_int(1) => true
is_int("1") => false

is_numeric(1) => true
is_numeric("1") => true


I hope now everything is clear for everybody.

Regards,
B. Grupe
P.S.: I think the general/help lists are more appropriate for these kind
of problems before asking internals.
P.P.S.: Sorry for potential spam, but I thought it is necessary to clear
it up once and for all.

Stefan Esser

20 years ago

Please move the discussion to php general mailinglist. This is a
usererror, a misunderstanding of is_int vs. is_numeric.

The documentation clearly states, that

is_numeric - Finds whether a variable is a number or a numeric string
is_int - Find whether a variable is an integer

anything within $_REQUEST is a string. Documentation clearly says that
is_int will return false, because a string is not an integer. is_numeric
will return true, because it is a numeric string.

Stefan

--
--------------------------------------------------------------------------
Stefan Esser                                               sesser@php.net
Hardened-PHP Project                         http://www.hardened-php.net/

GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0x15ABDA78
Key fingerprint       7806 58C8 CFA8 CE4A 1C2C  57DD 4AE1 795E 15AB DA78
--------------------------------------------------------------------------

Gareth Ardron

20 years ago

Stefan Esser wrote:

> Please move the discussion to php general mailinglist. This is a
> usererror, a misunderstanding of is_int vs. is_numeric.
>

My bad therefore, misunderstanding of the docs as you say.

Not sure I think it's entirely sane, but feh - it's been a long day,
what do I know, etc etc.

Cheers to those who replied.

Ron Korving

20 years ago

So when you said "and somebody enters, say "jkhdsjh" into the form, is_int()
returns 1" you were not really saying it as it was?

$var = "jkhdsjh";
is_int($var) should _not_ result in true. i figured you were talking about a
true bug here...

Ron


"Gareth Ardron" <gareth@fission.org.uk> wrote in message
news:438C9695.7030802@fission.org.uk...

Florian Anderiasch

20 years ago

Gareth Ardron wrote:

> Hi.
>
> Think I've just stumbled upon a possible bug with is_int.

Hello Gareth,
if I'm not mistaken, $_REQUEST['days'] is a string, and unless you use

if (!is_int(intval($_REQUEST['days'])) || $_REQUEST['days'] < 0) {

I see no problem in is_int taking a string with numerals inside as not int.

Greetings,
Florian

Gareth Ardron

20 years ago

Florian Anderiasch wrote:

> Gareth Ardron wrote:
>
>>Hi.
>>
>>Think I've just stumbled upon a possible bug with is_int.
>
> Hello Gareth,
> if I'm not mistaken, $_REQUEST['days'] is a string, and unless you use
>
> if (!is_int(intval($_REQUEST['days'])) || $_REQUEST['days'] < 0) {
>
> I see no problem in is_int taking a string with numerals inside as not int.

the problem with this (which I did try before posting) is that of course
is somebody enters a text string, and you run intval() on that, it'll
return 1, not 0 as it has content. Only if it's empty would it return
zero, and as such is_int() will return 1/true again.

Antony Dovgal

20 years ago

./sapi/cli/php -r 'var_dump(is_int("jkhdsjh"));'
bool(false)

./sapi/cli/php -v
PHP 5.1.2-dev (cli)

What am I doing wrong?

On 29.11.2005 18:57, Gareth Ardron wrote:

> Hi.
>
> Think I've just stumbled upon a possible bug with is_int.
>
> if you've got the following code:
>
> <form action='1.php' method='post'>
> <input type='text' name='days'>
> <input type='submit' name='submit' value='submit'>
> </form>
> <?php
> if (!is_int($_REQUEST['days']) || $_REQUEST['days'] < 0) {
>         $_REQUEST['days'] = 10;
> }
> print "<br>days::".$_REQUEST['days'];
> ?>
>
> and somebody enters, say "jkhdsjh" into the form, is_int() returns 1,
> thereby not setting the $_REQUEST['days'] variable to 10 - if I switch
> to using is_numeric then everything works as it should. Obviously, this
> isn't ideal as somebody could then enter 2.5 rather than the integers
> that I want to be passed.
>
> Looking at the source, this is in ext/standard/type.c in the
> php_is_type() function which seems to be messing up.
>
> Can anybody confirm this is:
> a) undesired behaviour and I'm not just being very "special" and
> b) that this is happening. I've tried on two boxes with 5.1.1[0] but
> it'd help to get somebody else's opinion
>
> If it's a bug, I'll do a patch up later tonight - just want to get it
> confirmed first.
>
> Cheers.
>

--
Wbr,
Antony Dovgal