|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #82016 usage of +- in strtotime results in unexpected output with PHP8.2
Submitted: 2023-07-27 08:26 UTC Modified: 2023-07-27 11:14 UTC
From: hallo at davidgreiner dot de Assigned:
Status: Not a bug Package: Date/time related
PHP Version: 8.2.8 OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: hallo at davidgreiner dot de
New email:
PHP Version: OS:


 [2023-07-27 08:26 UTC] hallo at davidgreiner dot de

In case of strtotime is used with '+- <date/time-string>' the output differs with PHP8.2 compared to PHP8.1 

In my opionion - depending on the usage and codebase - this COULD be a security risk, thats why i am posting this here and not in the public bug tracker in github. 

Test script:

$foo = strtotime('+-2 hours');
$bar = strtotime('-2 hours');

echo '+-2 hours equals -2 hours = ' . ($foo === $bar ? 'yes' : 'no') . PHP_EOL;

Expected result:
OUTPUT with PHP8.1: +-2 hours equals -2 hours = yes

Actual result:
OUTPUT with PHP8.2: +-2 hours equals -2 hours = no


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2023-07-27 11:13 UTC]
-Status: Open +Status: Not a bug -Type: Security +Type: Bug -Package: *General Issues +Package: Date/time related
 [2023-07-27 11:13 UTC]
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at and the instructions on how to report
a bug at

This issue comes nowhere close to the requirements for this being classed as a security. As a matter of fact, this change is documented in the PHP 8.2 migration guide:
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 24 01:01:31 2024 UTC