php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #52484 __set() ignores setting properties with empty names
Submitted: 2010-07-29 11:24 UTC Modified: 2010-08-01 15:27 UTC
From: bastard dot internets at gmail dot com Assigned: felipe
Status: Closed Package: Scripting Engine problem
PHP Version: 5.3.3 OS: Irrelevant
Private report: No CVE-ID:
 [2010-07-29 11:24 UTC] bastard dot internets at gmail dot com
Description:
------------
Within only __set(), you can set a value of a new property with an empty name ($p = null; $this->$p = 1;).  The property won't really be created though - the effects will be invisible to the user.  No errors, warnings, or notices are generated.  This lack of an error message might cause difficult to pinpoint bugs since all assignments of previously undeclared properties within object scope regardless of originating method are routed through __set();

Elsewhere in the object, attempting this will cause a fatal 'Cannot access empty property' error as expected.

Test script:
---------------
<?php

class A{

	function __set($prop, $val) {
		echo "SET $prop = $val\n";
		$this->$prop = $val; // should've caused error
		}

	}

$a = new A();
$prop = null;

$a->$prop = 2;

print_r($a); // empty object

?>

Expected result:
----------------
fatal 'Cannot set empty property' or 'invalid property name' error.

Actual result:
--------------
Nothing.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-07-29 11:29 UTC] bastard dot internets at gmail dot com
Er, actual result:

SET  = 2
A Object
(
)
 [2010-07-30 06:51 UTC] bastard dot internets at gmail dot com
To clarify my second paragraph in the description, only by removing __set() from the class will the desired error correctly generate.  IE, in any method, "$p = null; $this->$p = true;" will cause an expected error, just not if the __set() method exists.
 [2010-08-01 15:27 UTC] felipe@php.net
Automatic comment from SVN on behalf of felipe
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=301755
Log: - Fixed bug #52484 (__set() ignores setting properties with empty names)
 [2010-08-01 15:27 UTC] felipe@php.net
-Status: Open +Status: Closed -Package: Class/Object related +Package: Scripting Engine problem -Operating System: WIN +Operating System: Irrelevant -Assigned To: +Assigned To: felipe
 [2010-08-01 15:27 UTC] felipe@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2010-08-02 20:29 UTC] bastard dot internets at gmail dot com
Thanks!
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 24 21:01:55 2014 UTC