This is merely speculation, but I think it may be interpreting '096' as octal due to the leading zero. '9' is not a valid octal digit, so in that case, it would be an invalid IP address.

I can confirm the behavior, see <https://3v4l.org/tr4B3>.

ip2long() is defined in ext/standard/basic_functions.c[1].
However, it appears to me the "culprit" is inet_addr() and/or
inet_pton() to which PHP delegates without much further
processing. I don't know about inet_pton(), but indeed inet_addr()
interprets fields with a leading zero as octal integers[2], so in
this case it fails. As this behavior is documented[3] and makes
sense, I'm changing this ticket to feature request.

Changing the behavior of ip2long() would be possible, but that
would obviously cause a BC break, and as such likely would require
the RFC process[4].

[1] <https://github.com/php/php-src/blob/php-7.0.8/ext/standard/basic_functions.c#L3938-L3974>
[2] <http://publibn.boulder.ibm.com/doc_link/en_US/a_doc_lib/libs/commtrf2/inet_addr.htm>
[3] <http://php.net/manual/en/function.ip2long.php>
[4] <https://wiki.php.net/rfc/howto>

@cmb@php.net you are perfectly right!

I would like to suggest (raw idea), instead of changing ip2long(), to built-in another helper function instead, that process the IP in string format and "clean" it and make it concise.

it will be something like:

    function ip_clean(string $ip) : ?string { ... }


and just process splitting by dot returning in a "correct" format the string to be processed further if required.

ip_clean() could be easily implemented in userland, though, for
instance:

    <?php
    function ip_clean(string $ip) : ?string
    {
        return implode(
            '.',
            array_map(
                function ($el) {
                    return (int) $el;
                },
                explode('.', $ip)
            )
        );
    }

See <https://3v4l.org/NcNg7>.

Indeed.
My point was to do not always rewrite/paste the same function for each project, but instead have one built in. That even generalize better than the "ip_clean" raw idea proposed. Taking even the base as parameter for example.
Maybe would it be better to have inside a framework has ip validator instead of in a built in php way?

[Thanks for replies]