|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2009-08-16 22:09 UTC] cellog@php.net
Description: ------------ <?php filter_var(new stdClass, FILTER_VALIDATE_EMAIL); ?> throws a fatal error because stdClass can't be converted into a string. filter_var() should be more flexible and simply return false in this situation, it makes it very difficult to provide validation not just for untrusted user input but for untrusted third party use of libraries who may make it insecure by passing in the wrong value to a field for setting. PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Nov 12 15:00:02 2025 UTC |
<?php var_dump(filter_var(null, FILTER_VALIDATE_INT)); var_dump(filter_var(array(), FILTER_VALIDATE_INT)); var_dump(filter_var('hi', FILTER_VALIDATE_INT)); var_dump(filter_var(1.1, FILTER_VALIDATE_INT)); var_dump(filter_var(fopen('somefile', 'r'), FILTER_VALIDATE_INT)); var_dump(filter_var(1, FILTER_VALIDATE_INT)); var_dump(filter_var('1.0', FILTER_VALIDATE_INT)); ?> all work without error. <?php class blah {function __toString(){return '1';}} var_dump(filter_var(new blah, FILTER_VALIDATE_INT)); ?> works without error. Only filter_var with an object that doesn't implement __toString fails with an error. Either filter is incorrectly returning false with no error on all of those other random types, or you're wrong, Jani.