php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43372 FILTER_VALIDATE_INT returns null for numbers with leading zero(s)
Submitted: 2007-11-22 10:54 UTC Modified: 2013-08-05 17:28 UTC
From: gbml at bravogroup dot org Assigned: pajoye (profile)
Status: Not a bug Package: Filter related
PHP Version: 5.2.5 OS: linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: gbml at bravogroup dot org
New email:
PHP Version: OS:

 

 [2007-11-22 10:54 UTC] gbml at bravogroup dot org
Description:
------------
Filtering input numbers with leading zero(s) and filter FILTER_VALIDATE_INT does not produce number


Reproduce code:
---------------
// $_POST ["size"] has value "002"

filter_input (INPUT_POST, "size", FILTER_VALIDATE_INT)



Expected result:
----------------
2

Actual result:
--------------
null

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-22 11:13 UTC] pajoye@php.net
See FILTER_FLAG_ALLOW_OCTAL.
 [2013-08-05 14:05 UTC] kodafixed at gmail dot com
FILTER_FLAG_ALLOW_OCTAL is not a feasible workaround for this issue.

echo filter_var('08', FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_OCTAL) ? "OKAY" : "NOT OKAY";
// RESULT: "NOT OKAY"

FILTER_FLAG_ALLOW_OCTAL completely invalidates tests where the value has a leading 0 and includes an 8 or 9.
 [2013-08-05 15:41 UTC] rasmus@php.net
Don't use FILTER_VALIDATE_INT if you don't want to validate decimal notation 
integers. Decimal notation integers do not have a leading 0, except for 0 itself, 
of course. If you just want a filter that checks if the input is entirely made of 
digits, just use a regex. eg.

filter_var($string, FILTER_VALIDATE_REGEXP, ["options"=>["regexp"=>"/^[0-
9]+$/"]]);
 [2013-08-05 16:21 UTC] kodafixed at gmail dot com
That assumes one has control over the input. If for example, the input data comes from a form submission then it may in fact come into the program with leading zero(es). In order to make the data in this scenario "valid" for the test you would have to cast it or manipulate it - which makes using the built-in function moot. 
The concept that filter_var('8', FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_OCTAL) should return 8, but filter_var('08', FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_OCTAL) should return false is ludicrous.
 [2013-08-05 17:28 UTC] rasmus@php.net
How is it ludicrous? You understand that 08 is an invalid value in octal, right? 
The filters are all about filtering out invalid input. If you specify you want 
valid integers (which are in decimal notation by default) and you also say you 
want to accept integers in octal notation, then it *must* return false on a value 
which is neither an octal nor a decimal representation of an integer.
 [2017-06-17 09:45 UTC] matthew at slyman dot org
Potential work-around: run your input through this filter, before validating it as an integer:
$input_without_leading_zeroes=\preg_replace('/^0*/','',$input);

This work-around is useful in cases where you already know that your input is going to be in decimal (e.g. for an HTML <input type="number" … > control

People from a digital electronics background might differ with Rasmus' assertion that numbers with leading zeroes are not valid integers.

Note that FILTER_VALIDATE_FLOAT does not exhibit the same behaviour! Floating-point number-strings with leading zeroes are treated as valid, and converted accordingly into floating point PHP variables, on the assumption that they are in decimal — although FILTER_VALIDATE_FLOAT has its own deficiencies/ idiosyncrasies, in that it assumes that floating-point number-strings are expressed with a "." for a decimal point — rather than "," (comma), or even "٫" (Arabic decimal separator or momayyez)!
https://en.wikipedia.org/wiki/Decimal_mark

Fundamentally, we cannot expect the language to cover all these edge cases internally (otherwise, the language and its built-in features could end up quite bloated and inefficient). Someone has to decide which features to support, and which not — and someone has to standardise how the language behaves in edge-cases like these!

Thanks @Rasmus for that!
 [2017-06-17 09:56 UTC] matthew at slyman dot org
p.s. Note also the ZEROFILL option in MySQL: people with a MySQL background, or certain other database backgrounds, might also differ with the opinion that numbers with leading zeroes are not valid integers!

It all depends on your application, and how you want to treat such numbers. Use the work-around I have described, and you will have full control…
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Apr 24 12:01:29 2024 UTC