php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43960 strtotime() returns timestamp in the future when given a bogus string
Submitted: 2008-01-29 05:29 UTC Modified: 2008-02-25 22:43 UTC
From: chris dot corbyn at sitepoint dot com Assigned: derick (profile)
Status: Closed Package: Date/time related
PHP Version: 5.2.5 OS: OS X/Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: chris dot corbyn at sitepoint dot com
New email:
PHP Version: OS:

 

 [2008-01-29 05:29 UTC] chris dot corbyn at sitepoint dot com
Description:
------------
When writing a unit test to ensure bogus data cannot be passed to our e-commerce paypal request-response library we've stumbled upon an unexpected problem.  I enjoy the occassional (1-2 per day) slice whilst at work so I passed this as a test bogus string.

<?php

var_dump(strtotime('i like to eat slices at work'));

?>

This returns a timestamp exactly 2 hours in the future.  This has been tested on 2 different macs and a linux server.

We've pinned it down to the "i".  What we really expected was a boolean false return value.

Reproduce code:
---------------
<?php

var_dump(strtotime('i like to eat slices at work'));
var_dump(strtotime('i')); //same

?>

Expected result:
----------------
A boolean FALSE return is expected.

Actual result:
--------------
An integer representing a UNIX timestamp exactly 2 hours in the future is returned.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-01-29 07:31 UTC] derick@php.net
"I" is seen as a timezone (Like L or Z could be). There is thus nothing wrong with that specific string. However, in the first one the parser sees many different timezone strings, parsing with date_parse() shows:

derick@kossu:~/dev/php/php-5.3dev$ sapi/cli/php 
<?php
var_dump(date_parse("i like to eat slices at work"));
?>
array(16) {
  ["year"]=>
  bool(false)
  ["month"]=>
  bool(false)
  ["day"]=>
  bool(false)
  ["hour"]=>
  bool(false)
  ["minute"]=>
  bool(false)
  ["second"]=>
  bool(false)
  ["fraction"]=>
  bool(false)
  ["warning_count"]=>
  int(6)
  ["warnings"]=>
  array(6) {
    [2]=>
    string(29) "Double timezone specification"
    [7]=>
    string(29) "Double timezone specification"
    [10]=>
    string(29) "Double timezone specification"
    [14]=>
    string(29) "Double timezone specification"
    [21]=>
    string(29) "Double timezone specification"
    [24]=>
    string(29) "Double timezone specification"
  }
  ["error_count"]=>
  int(0)
  ["errors"]=>
  array(0) {
  }
  ["is_localtime"]=>
  bool(true)
  ["zone_type"]=>
  int(2)
  ["zone"]=>
  int(-540)
  ["is_dst"]=>
  bool(false)
  ["tz_abbr"]=>
  string(1) "I"
}

I don't know whether I can make a double timezone string an error, as it's common to use things like "GMT+04:00" which would trigger the same error then - while being a valid string. I think the most I can do if when it sees *more* than two timezones it turns it into errors.
 [2008-01-29 10:15 UTC] chris dot corbyn at sitepoint dot com
Thanks for the detailed and useful explanation.  Checking for more than 
two occurrences of timezone specification and returning false is such a 
scenario would be the way to go I agree.

Thanks very much,

Chris.
 [2008-02-25 22:43 UTC] derick@php.net
This is in CVS now (or was for some weeks).
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 15 13:01:34 2025 UTC