Is there a compelling reason to use PHP's operator === in comparison operations, over ==? -
say have code:
$str = '5'; $int = 5;
for comparison, there reason use (with conversion):
if ($int === intval($str)) //...
or use native php facilities?
if ($int == $str) //...
to me, ==
looks simpler, perhaps @ expense of having php work me.
using '==' tends lead subtle bugs - eg if 2 strings numbers, php not compare them strings, can give unexpected results - common/scary example is:
<?php $actual_password = '240610708'; $provided_password = 'qnkcdzo'; // these presumably stored in database $stored_password_md5 = md5($actual_password); //0e462097431906509019562988736854; $stored_password_hash = password_hash($actual_password, password_default); $computed_password_md5 = md5($provided_password); //0e830400451993494058024219903391 var_dump($stored_password_md5 == $computed_password_md5); // bool(true) - bad! no! var_dump($stored_password_md5 === $computed_password_md5); // bool(false) - better, still no. vulnerable timing attacks var_dump(hash_equals($stored_password_md5, $computed_password_md5)); // bool(false) getting somewhere var_dump(password_verify($provided_password, $stored_password_hash)); // bool(false) best
while in specific example, problem doesn't occur, possible problems lead lot of people recommending /always/ use ===, don't have remember when == safe , when isn't.
Comments
Post a Comment