Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I am very aware that it is trivial to handle notices, errors and warnings. The problem is that PHP does not do this by default which allows people to exploit undocumented behavior.

As for handling invalid input, I think you should actually check what some of the functions output some day.

For example, decbin clearly states that the input should be an integer but if I pass it a string.....

Code/ctsr ยป php -r 'echo decbin("invalid input");' 0%

Zero is clearly not a NULL value. This is one I ran into this morning with php 5.3.8, I've seen this issue crop up in many other functions, they don't return NULL. Some return NULL, some return 0, some return '', some return '0', some return FALSE.



PHP was designed (I use the term loosely) to get dynamic websites up and running very quickly, and it's default configuration succeeds at that. So I don't think it's fair to call the loose error behavior a problem in PHP, as changing that would go against that ease of use, even if it's a problem when writing complex software with PHP.

I think a simple "use strict"-type declaration would go a long way for making software that's actually reliable rather than the barrage of set_error_handler, ini_set and related calls, but oh well, I'll file a feature request. It gets more complicated when security enters the mix (remember magic quotes?), but there are about nine thousand different frameworks which deal with that better since they're actually designed for a specific purpose.


I agree with you there and I'd be happy to see "use strict" in PHP.


Submit a ticket.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: