php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #30143 if () statement not parsing decimals fetched from mysql database correctly
Submitted: 2004-09-18 18:56 UTC Modified: 2004-09-21 02:36 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: tonglebeak at gmail dot com Assigned:
Status: Not a bug Package: Unknown/Other Function
PHP Version: 4.3.8 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2004-09-18 18:56 UTC] tonglebeak at gmail dot com 
Description:
------------
Normally, whenever and int 0 is put into an if statement, the statement is returned as false. Same thing with double 0: it returns false. However, with a decimal, it's returning true. 0.0000000 is an example that is returning true. This can lead to possible security issues for those who rely on the if statement, and are using it on a decimal taken from a database for example for security checks and such.

Reproduce code:
---------------
<?

$num='0.000000000';

if ($num) echo 'decimal true';

if ((int)$num) echo 'int true';

if ((double)$num) echo 'double true';

?>

Expected result:
----------------
I expect nothing to return true at all.

Actual result:
--------------
'decimal true' is returned, meaning "if (0.000000000)" is returning true.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-19 00:53 UTC] tonglebeak at gmail dot com 
Ok, I'm going to make a big edit here.

It is only occurs when it's fetched from a database. I just realized the other way shows it as a string v_v.

Here's an example of the security issue:



<?

//my file to connect to the database is here

$row=mysql_fetch_row(mysql_query('SELECT score FROM games WHERE score=0 LIMIT 0,1'));

/*Please note: the field for 'score' is a decimal type, and the data being fetched is 0.0000000000*/

if ($row[0]) echo 'true';

?>



And guess what: it echos 'true';
 [2004-09-21 02:36 UTC] derick@php.net 
Floating point values have a limited precision. Hence a value might 
not have the same string representation after any processing. That also
includes writing a floating point value in your script and directly 
printing it without any mathematical operations.
 
Thank you for your interest in PHP.

.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat May 04 11:01:32 2024 UTC