Apache/1.3.19

In the switch block, the following code generates an invalid server response:
      case "":
        if($var) {
echo "FALSE";
            return $ret;
} echo "TRUE";
        else {
            return !$ret;
}



included file named parse.php, an advanced template parser, contains the following function:

Typical input to the function would be:
iftest("if", "cats")
iftest("else");
iftest("ifnot", "cats!=4")
iftest("elseif", "homepage==domain+'index.php'")

the dehash function parses variables as they are passed to the template. e.g., homepage=>'http://www.php.net/index.php', domain=>'http://www.php.net/', so the last example would return true.

function iftest($func,$arg) {
    global $var_hash;

    $var="";
    $op="";
    $val="";
    $i=0;

    if($func=="else") {
        return TRUE;
    }

    do {
        $var.=$arg[$i++];
    } while($i<strlen($arg)&&$arg[$i]!="="&&$arg[$i]!="!"&&$arg[$i]!="<"&&$arg[$i]!=">");
    if($i<strlen($arg)) {
        do {
            $op.=$arg[$i++];
        } while(($arg[$i]=="="||$arg[$i]=="!"||$arg[$i]=="<"||$arg[$i]==">")&&$i<strlen($arg));
    }
    if($i<strlen($arg)) {
        do {
            $val.=$arg[$i++];
        } while($i<strlen($arg));
    }

    if($val[0]=='"'||$val[0]=="'") {
        $val=substr($val, 1, strlen($val)-2);
    }

    $var=dehash($var);

    if($func=="if"||$func=="elseif") {
        $ret=TRUE;
    }
    elseif($func=="ifnot"||$func="elseifnot") {
        $ret=FALSE;
    }

    switch($op) {
      case "==":
        if($var==$val)
            return $ret;
        else
            return !$ret;
        break;
      case "!=":
        if($var!=$val)
            return $ret;
        else
            return !$ret;
        break;
      case ">=":
        if($var>=$val)
            return $ret;
        else
            return !$ret;
        break;
      case "<=":
        if($var<=$val)
            return $ret;
        else
            return !$ret;
        break;
      case ">":
        if($var>$val)
            return $ret;
        else
            return !$ret;
        break;
      case "<":
        if($var<$val)
            return $ret;
        else
            return !$ret;
        break;
      case "":
        if($var) {
echo "FALSE";
            return $ret;
} echo "TRUE";
        else {
            return !$ret;
}
        break;
      default:
        return FALSE;
    }

    return FALSE;
}