Thank you for your bug report.

Your example code can be summarized as follows:
<?php var_dump(checkdate('01', '01', '1980')); ?>

I would expect this to return true, because January 1st 1980 is a valid date. Why do you think it is an invalid date?

hmm, indeed I changed my scripted at the last minute because I got a deprecated notice.

My first test was as following:
<?php

$date = "01-01-1980 <script>alert('test');</script>";
$aDate_parts = split('-', $date);
print_r($aDate_parts);
var_dump(
    checkdate(
        $aDate_parts[1], // Month
        $aDate_parts[0], // Day
        $aDate_parts[2] // Year
    )
);

?>

This example will result in the following array:
<?php

Array
(
    [0] => 01
    [1] => 01
    [2] => 1980 <script>alert('test');</script>
)

?>

And it will return a boolean (true)

The function checkdate() takes three integers as arguments. That means that if you pass it a string, it will be cast to an int. The string "1980 <script>alert('test');</script>" cast to an int will result in 1980.

So
checkdate("01", "01", "1980 <script>alert('test');</script>")
is equivalent to
checkdate(1, 1, 1980)

This is not a bug in PHP, rather a limitation of checkdate: it assumes that you pass it numbers. You should check yourself that your input is numeric.

ok, sounds logical indeed, the ticket can be closed in this case, I only recommend to add a notice / warning / hint on the manual page perhaps. To avoid that people use checkdate() and after that insert the date directly into the database.

Thanks for the time

There is actually a warning already:

derick@kossu:~$ php
<?php
checkdate("01", "01", "1980 <script>alert('test');</script>");
?>

Notice: A non well formed numeric value encountered in /home/derick/- on line 2

Call Stack:
    8.1010     653592   1. {main}() /home/derick/-:0
    8.1010     654376   2. checkdate(string(2), string(2), string(36)) /home/derick/-:2

A yes, you are right, I have forgotten that E_NOTICE is disabled at the company I work, I added error_reporting(E_ALL); and I see the notice.

Thanks for your reply and your time