php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #74222 $this value can be overwritten with a variable variable.
Submitted: 2017-03-08 03:56 UTC Modified: 2017-03-08 04:54 UTC
From: marco dot agnoli at me dot com Assigned:
Status: Not a bug Package: *General Issues
PHP Version: PHP 7.0.x & PHP 5.x OS: OS X
Private report: No CVE-ID: None
 [2017-03-08 03:56 UTC] marco dot agnoli at me dot com
Description:
------------
I don't know whether that's intentional behavior or not but the $this value can be overwritten with a variable variable (see test code below).

Test script:
---------------
<?php

$var = 'this';

$$var = 10;

echo $this; // Echos 10

// Generates a fatal error
$this = 10;

Expected result:
----------------
A PHP Fatal error message.

Actual result:
--------------
$this gets silently overwritten.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-03-08 04:47 UTC] pollita@php.net
-Status: Open +Status: Not a bug
 [2017-03-08 04:47 UTC] pollita@php.net
PHP version *is* relevant.  So is trying to reassign $this is a context where it matters.

See: https://3v4l.org/MpDOn
 [2017-03-08 04:51 UTC] marco dot agnoli at me dot com
Sorry, I tested it again and saw the following behavior:

PHP 7.1.x is not affected while PHP 5.6.x and PHP 7.0.x are.
 [2017-03-08 04:54 UTC] marco dot agnoli at me dot com
-PHP Version: Irrelevant +PHP Version: PHP 7.0.x & PHP 5.x
 [2017-03-08 04:54 UTC] marco dot agnoli at me dot com
Updated affected PHP versions.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Dec 21 12:01:31 2024 UTC