|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2023-07-27 11:13 UTC] derick@php.net
-Status: Open
+Status: Not a bug
-Type: Security
+Type: Bug
-Package: *General Issues
+Package: Date/time related
[2023-07-27 11:13 UTC] derick@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Nov 12 21:00:01 2025 UTC |
Description: ------------ Hello! In case of strtotime is used with '+- <date/time-string>' the output differs with PHP8.2 compared to PHP8.1 In my opionion - depending on the usage and codebase - this COULD be a security risk, thats why i am posting this here and not in the public bug tracker in github. Test script: --------------- <?php $foo = strtotime('+-2 hours'); $bar = strtotime('-2 hours'); echo '+-2 hours equals -2 hours = ' . ($foo === $bar ? 'yes' : 'no') . PHP_EOL; Expected result: ---------------- OUTPUT with PHP8.1: +-2 hours equals -2 hours = yes Actual result: -------------- OUTPUT with PHP8.2: +-2 hours equals -2 hours = no