Is there a compelling reason to use PHP's operator === in comparison operations, over ==? -


say have code:

$str = '5'; $int = 5; 

for comparison, there reason use (with conversion):

if ($int === intval($str)) //... 

or use native php facilities?

if ($int == $str) //... 

to me, == looks simpler, perhaps @ expense of having php work me.

using '==' tends lead subtle bugs - eg if 2 strings numbers, php not compare them strings, can give unexpected results - common/scary example is:

<?php  $actual_password = '240610708'; $provided_password = 'qnkcdzo';  // these presumably stored in database $stored_password_md5 = md5($actual_password); //0e462097431906509019562988736854; $stored_password_hash = password_hash($actual_password, password_default);  $computed_password_md5 = md5($provided_password); //0e830400451993494058024219903391  var_dump($stored_password_md5 == $computed_password_md5); // bool(true) - bad! no! var_dump($stored_password_md5 === $computed_password_md5); // bool(false) - better, still no. vulnerable timing attacks var_dump(hash_equals($stored_password_md5, $computed_password_md5)); // bool(false) getting somewhere var_dump(password_verify($provided_password, $stored_password_hash)); // bool(false) best 

while in specific example, problem doesn't occur, possible problems lead lot of people recommending /always/ use ===, don't have remember when == safe , when isn't.


Comments

Popular posts from this blog

css - SVG using textPath a symbol not rendering in Firefox -

Java 8 + Maven Javadoc plugin: Error fetching URL -

node.js - How to abort query on demand using Neo4j drivers -