php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #49702 I have access to the private attributes of a give class
Submitted: 2009-09-28 18:11 UTC Modified: 2009-09-29 07:04 UTC
From: vito_web at yahoo dot com Assigned:
Status: Not a bug Package: Class/Object related
PHP Version: 5.3.0 OS: Linux
Private report: No CVE-ID: None
 [2009-09-28 18:11 UTC] vito_web at yahoo dot com
Description:
------------
<?php
/**
 * Define MyClass
 */
class MyClass
{
    public $public = 'Public';
    protected $protected = 'Protected';
    private $private = 'Private';

    function printHello()
    {
        echo $this->public;
        echo $this->protected;
        echo $this->private;
    }
}

$obj = new MyClass();
echo $obj->public; // Works
//echo $obj->protected; // Fatal Error
//echo $obj->private; // Fatal Error
$obj->printHello(); // Shows Public, Protected and Private


/**
 * Define MyClass2
 */
class MyClass2 extends MyClass
{
    // We can redeclare the public and protected method, but not 
private
    protected $protected = 'Protected2';

    function printHello()
    {
        echo $this->public;
        echo $this->protected;
        echo $this->private;
    }
}

$obj2 = new MyClass2();
echo $obj2->public; // Works
echo $obj2->private = "Hacked";
echo $obj2->private; // Undefined
//echo $obj2->protected; // Fatal Error
$obj2->printHello(); // Shows Public, Protected2, Undefined

?>

Expected result:
----------------
PHP Fatal error:  Cannot access private property MyClass2::$private 
in......

Actual result:
--------------
PublicPublicProtectedPrivatePublicHackedHackedPublicProtected2Hacked

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-09-28 18:25 UTC] vito_web at yahoo dot com
<?php

class MyClass {
   private $private = 'Private';
}

class MyClass2 extends MyClass {
    protected $protected = 'Protected2';
}

$obj2 = new MyClass2();
$obj2->private = "Hacked";
echo $obj2->private; // should be fatal error by accessing the private 
property, but it displays the string "Hacked"

?>
 [2009-09-28 19:02 UTC] sjoerd@php.net
Thank you for your report.

The behavior you describe is not a bug. The statement
$obj2->private = "Hacked";
does not change the private property of MyClass. Instead, it creates a new public property on MyClass2.

 [2009-09-29 07:04 UTC] vito_web at yahoo dot com
Sorry, I thought that it works like in java. In java such code would not 
even compile. Not very good decision for OOP in PHP to create another 
private property at the time when the parent has already such property 
with the same name. Anyway thanks
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Wed Apr 01 14:00:02 2026 UTC