PHP intval () Decimal Time Security vulnerability Analysis _php Tutorial

This article first introduced the PHP intval simple usage, it can convert characters, numbers, decimals conversion gray digital data, but in the conversion will appear some problems such as decimal 1.1 will be converted to 1, see the example below.

The variable is converted to an integer type.

Syntax: int intval (mixed var, int [base]);

return value: Integer

Function type: PHP system function

Content Description

This function converts a variable into an integer type. The parameter base that can be omitted is the base of the conversion, and the default value is 10. The converted variable var can be an array or any type variable other than the class.

Intval () Improper use of security vulnerability analysis

The Intval function has a feature: "Until a number or sign is encountered to start the conversion, and then the non-numeric or end of the string () end Conversion", in some applications due to the Intval function This feature is not known enough, the use of errors caused by bypassing some security decisions lead to security vulnerabilities.

Second, analysis

The code is as follows

Copy Code

< P>php_function (intval) { Zval **num, **arg_base; Int base; Switch (Zend_num_args ()) { Case 1: If (ZEND_GET_PARAMETERS_EX (1, &num) = = FAILURE) { Wrong_param_count; } Base = ten; Break; Case 2: If (ZEND_GET_PARAMETERS_EX (2, &num, &arg_base) = = FAILURE) { Wrong_param_count; } Convert_to_long_ex (arg_base); Base = z_lval_pp (Arg_base); Break; Default: Wrong_param_count; } Retval_zval (*num, 1, 0); Convert_to_long_base (Return_value, base); } Zend/zend_operators.c->>convert_to_long_base () ... Case is_string: Strval = z_strval_p (OP); Z_lval_p (OP) = Strtol (Strval, NULL, base); Str_free (strval); Break;

When the Intval function accepts that the string parameter is called convert_to_long_base () processing, the next call is Z_lval_p (OP) = Strtol (Strval, NULL, Base), and the parameter is handled by the Strtol function.

The function prototypes are as follows:

Long int strtol (const char *nptr,char **endptr,int base);

This function converts the parameter nptr string based on the parameter base to the number of growth integers, the parameter base range from 2 to 36, or 0. The parameter base represents the input method used, such as the base value of 10 is 10, if the base value of 16 is used 16.

The process is:

Strtol () scans the parameter nptr string, skips the preceding space character until a number or sign is encountered, and then ends the conversion with a non-numeric or string end () and returns the result.

Then when the intval is used in the judgment of if and so on, it will cause this judgment to be meaningful, leading to a security breach.

Third, the test code

The code is as follows

Copy Code

$o = 0.1; for ($a = 1; $a < $a + +) { $o + = 0.1; echo " Intval ($o) = ". Intval ($o); if (Intval ($o)) { Print ("true"); }else{ Print ("false"); } }?> Output Result: Intval (0.2) = 0 false Intval (0.3) = 0 false Intval (0.4) = 0 false Intval (0.5) = 0 false Intval (0.6) = 0 false Intval (0.7) = 0 false Intval (0.8) = 0 False Intval (0.9) = 0 false Intval (1) = 0 false Intval (1.1) = 1 true Intval (1.2) = 1 true Intval (1.3) = 1 true Intval (1.4) = 1 true Intval (1.5) = 1 true Intval (1.6) = 1 true Intval (1.7) = 1 true Intval (1.8) = 1 true Intval (1.9) = 1 true Intval (2) = 2 true .....

The difference between PHP intval and int

The code is as follows

Copy Code

$t = ' 165 '; echo GetType ((int) ($t)); Echo '; Echo GetType (Intval ($t)); Output result: integer integer value:165 $t = ' a165 '; echo GetType ((int) ($t)); Echo '; Echo GetType (Intval ($t)); Result integer integer value:0,0 $string = "2a"; $string 1=intval ($string); Echo ' $string 1 Value: '. $string 1. ' $string 2 value: ';//single quotation mark does not output variable, output as-is $string 2= (int) ($string); Echo $string 2

http://www.bkjia.com/PHPjc/629657.html www.bkjia.com true http://www.bkjia.com/PHPjc/629657.html techarticle This article first introduced the PHP intval simple usage, it can put characters, numbers, decimals conversion gray digital data, but in the conversion will appear some problems such as decimal 1.1 will be converted to 1, the following ...

