|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2009-02-06 22:40 UTC] johannes@php.net
[2009-02-09 13:20 UTC] michael dot buergi at zhdk dot ch
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Dec 04 05:00:01 2025 UTC |
Description: ------------ current situation: Since PHP allows the characters 0x7f through 0xff in constant names, you can create constant names that contain non-printable characters - like the non-breaking space (NBSP) chr(160)! Sadly, any PHP-IDE (p.e. the Zend Studio for Eclipse) or editor that I have checked with recognises NBSP as whitespace. So this seems to be a perfect way to sabotage someones code. Just replace an ordinary space with NBSP and you are screwed. I pasted a small php script into "reproduce code" that defines a constant and echoes it two times, as it seems. But since there is a NBSP in front of the constant's name, PHP just echoes "?SOME_CONST". the second echo is completely ignored since it searches for the constant "echo?SOME_CONST". Motivation: Look at the sample script in a PHP editor and you won't find any error. Only in case you have E_NOTICE reporting turned on (which I don't) you would eventually find the mistake. change request: Having non-printable characters in constant names seems to be a bad idea for me. therefore I request that not the whole 0x7f-0xff character range could be used in constant names, but just the sane ones. And since I'm already here, why not raise the error-level from "notice" to "warning" if a constant's name is not found? You could introduce a php.ini flag that controls this behaviour. Thank you very much and kind regards Michael Reproduce code: --------------- <?php error_reporting(E_ALL); define('SOME_CONST', 'foobar'); echo ?SOME_CONST; echo?SOME_CONST; ?> Expected result: ---------------- foobarfoobar Actual result: -------------- ?SOME_CONST