|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #60475 Assignments of $this in some implicit __toString contexts get broken
Submitted: 2011-12-08 16:58 UTC Modified: 2017-01-02 14:13 UTC
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: ctrahey at rubicon dot com Assigned: nikic (profile)
Status: Closed Package: Class/Object related
PHP Version: 5.3.8, 5.4.0RC2, 5.5.0-dev OS: Windows 7, Ubuntu 10
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: ctrahey at rubicon dot com
New email:
PHP Version: OS:


 [2011-12-08 16:58 UTC] ctrahey at rubicon dot com
Tested with php 5.3.8 on Windows 7, 5.4.0RC2 Win32, and 5.4.0RC2 (cli) on Ubuntu 10.04.3

When an object is implicitly used as a string when passed to some php functions, __toString is called as expected, but any assignments of $this from within __toString are eventually broken and point instead to the string that gets returned. This behavior occurs only in some php functions, and never if you cast as string while passing into the functions.

This behavior has been observed when passing objects into at least these php functions:
str_replace, preg_replace, preg_match_all, sprintf.

There are many php string functions that do not behave this way (they allow __toString-created references to $this persist as references to the object).

For extra fun, play around with htmlspecialchars, echo-ing the output... I suspect that's a whole different issue, but related (possible memory leak there).

Test script:
class Primary {
 public function __toString() {
  $GLOBALS['anObject'] = $this;
  return 'toString output from Primary';
$Foo = new Primary;
str_replace('', '', $Foo);
// expected to be object of class Primary, actually string

Expected result:
object(Primary)#1 (0) { } 

Actual result:
string(28) "toString output from Primary" 


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-12-12 18:25 UTC] ctrahey at rubicon dot com
-PHP Version: 5.3.8 +PHP Version: 5.3.8, 5.4.0RC2, 5.5.0-dev
 [2011-12-12 18:25 UTC] ctrahey at rubicon dot com
Tested against trunk (5.5.0-dev, revision 320923) compiled on Ubuntu 10.04.3 with same (incorrect) result.
 [2014-01-22 11:30 UTC] joe dot bowman at edigitalresearch dot com
This issue can be replicated in PHP version 5.4.19 and 5.5.3 (via php-fpm) on Centos 6.4, specifically passing Objects into in_array (object has a __toString() method, and is being compared to an array of strings).
 [2015-07-07 21:19 UTC]
The issue appears to be resolved in PHP 7: <>.
 [2017-01-02 14:13 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2017-01-02 14:13 UTC]
Closing as the bug has been fixed in PHP 7.0 and PHP 5.6 is going out of active support.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue May 21 14:01:33 2024 UTC