php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43960 strtotime() returns timestamp in the future when given a bogus string
Submitted: 2008-01-29 05:29 UTC Modified: 2008-02-25 22:43 UTC
From: chris dot corbyn at sitepoint dot com Assigned: derick (profile)
Status: Closed Package: Date/time related
PHP Version: 5.2.5 OS: OS X/Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: chris dot corbyn at sitepoint dot com
New email:
PHP Version: OS:

 

 [2008-01-29 05:29 UTC] chris dot corbyn at sitepoint dot com
Description:
------------
When writing a unit test to ensure bogus data cannot be passed to our e-commerce paypal request-response library we've stumbled upon an unexpected problem.  I enjoy the occassional (1-2 per day) slice whilst at work so I passed this as a test bogus string.

<?php

var_dump(strtotime('i like to eat slices at work'));

?>

This returns a timestamp exactly 2 hours in the future.  This has been tested on 2 different macs and a linux server.

We've pinned it down to the "i".  What we really expected was a boolean false return value.

Reproduce code:
---------------
<?php

var_dump(strtotime('i like to eat slices at work'));
var_dump(strtotime('i')); //same

?>

Expected result:
----------------
A boolean FALSE return is expected.

Actual result:
--------------
An integer representing a UNIX timestamp exactly 2 hours in the future is returned.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-01-29 07:31 UTC] derick@php.net
"I" is seen as a timezone (Like L or Z could be). There is thus nothing wrong with that specific string. However, in the first one the parser sees many different timezone strings, parsing with date_parse() shows:

derick@kossu:~/dev/php/php-5.3dev$ sapi/cli/php 
<?php
var_dump(date_parse("i like to eat slices at work"));
?>
array(16) {
  ["year"]=>
  bool(false)
  ["month"]=>
  bool(false)
  ["day"]=>
  bool(false)
  ["hour"]=>
  bool(false)
  ["minute"]=>
  bool(false)
  ["second"]=>
  bool(false)
  ["fraction"]=>
  bool(false)
  ["warning_count"]=>
  int(6)
  ["warnings"]=>
  array(6) {
    [2]=>
    string(29) "Double timezone specification"
    [7]=>
    string(29) "Double timezone specification"
    [10]=>
    string(29) "Double timezone specification"
    [14]=>
    string(29) "Double timezone specification"
    [21]=>
    string(29) "Double timezone specification"
    [24]=>
    string(29) "Double timezone specification"
  }
  ["error_count"]=>
  int(0)
  ["errors"]=>
  array(0) {
  }
  ["is_localtime"]=>
  bool(true)
  ["zone_type"]=>
  int(2)
  ["zone"]=>
  int(-540)
  ["is_dst"]=>
  bool(false)
  ["tz_abbr"]=>
  string(1) "I"
}

I don't know whether I can make a double timezone string an error, as it's common to use things like "GMT+04:00" which would trigger the same error then - while being a valid string. I think the most I can do if when it sees *more* than two timezones it turns it into errors.
 [2008-01-29 10:15 UTC] chris dot corbyn at sitepoint dot com
Thanks for the detailed and useful explanation.  Checking for more than 
two occurrences of timezone specification and returning false is such a 
scenario would be the way to go I agree.

Thanks very much,

Chris.
 [2008-02-25 22:43 UTC] derick@php.net
This is in CVS now (or was for some weeks).
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 15 13:01:34 2025 UTC