PHP intval () Decimal Time Security vulnerability analysis

Variable to an integer type.

Syntax: int intval (mixed var, int [base]);

return value: Integer

Function type: PHP system function

Content Description

This function converts a variable to an integer type. The parameter base that can be omitted is the base of the transformation, and the default value is 10. The converted variable var can be an array or any type of variable other than the class.

Analysis of security vulnerabilities using improper intval ()

The Intval function has an attribute of: "Until the number or sign symbol to start the conversion, and then encounter non-numeric or end of the string () conversion", in some applications due to the Intval function This feature is not known enough, the use of errors leads to bypass some security judgments lead to security vulnerabilities.

Second, analysis

The code is as follows

Php_ FUNCTION (intval) { Zval **num, **arg_base; Int base; Switch (Zend_num_args ()) { Case 1: If (ZEND_GET_PARAMETERS_EX (1, &num) = = failure) { Wron G_param_count; } Base = ten; Break; Case 2: If (ZEND_GET_PARAMETERS_EX (2, &num, &arg_base) = = failure) { Wrong_param_count; } Convert_to_long_ex (arg_base); Base = z_lval_pp (Arg_base); Break; Default: Wrong_param_count; } Retval_zval (*num, 1, 0); Convert_to_long_base (Return_value, base); } Zend/zend_operators.c->>convert_to_long_base () ... Case is_string: Strval = z_strval_p (OP); Z_lval_p (OP) = Strtol (Strval, NULL, base); Str_free (strval); Break;

When the Intval function accepts a string parameter that calls Convert_to_long_base () processing, the next call is Z_lval_p (OP) = Strtol (Strval, NULL, Base), and the parameters are processed by the Strtol function.

The function prototype is as follows:

Long int strtol (const char *nptr,char **endptr,int base);

This function converts the parameter nptr string based on the parameter base to the number of growth integers, the parameters base range from 2 to 36, or 0. Parameter base represents the method used, such as the base value of 10 is 10, if the base value of 16 is 16.

The process is:

Strtol () scans the parameter nptr string and skips the preceding space character until it encounters a number or positive sign to begin the conversion, and then ends the conversion at the end of a non-numeric or string () and returns the result.

Then when the intval is used in the judgment of if, it will cause this judgment to be meaningful, and thus lead to security vulnerabilities.

Third, test code

The code is as follows

<?php $o = 0.1; for ($a = 1; $a < $a + +) { $o + 0.1; echo "<br/>intval ($o) =". Intval ($o); if (Intval ($o)) { Print ("&nbsp;true"); }else{ Print ("&nbsp;false"); } }?> Output results: Intval (0.2) = 0 false Intval (0.3) = 0 false Intval (0.4) = 0 false Intval (0.5) = 0 false Intval (0.6) = 0 false Intval (0.7) = 0 false Intval (0.8) = 0 False Intval (0.9) = 0 false Intval (1) = 0 false Intval (1.1) = 1 true Intval (1.2) = 1 true Intval (1.3) = 1 true Intval (1.4) = 1 true Intval (1.5) = 1 true Intval (1.6) = 1 true Intval (1.7) = 1 true Intval (1.8) = 1 true Intval (1.9) = 1 true Intval (2) = 2 true .....

The difference between PHP intval and int

code is as follows

$t = ' 165 '; Echo GetType ((int) ($t)); Echo ' Echo GetType (Intval ($t)); //Output result: integer integer value:165 $t = ' a165 '; Echo GetType ((int) ($t)); Echo ' Echo GetType (Intval ($t)); //result integer integer value:0,0 $string = "2a"; $string 1=intval ($string); Echo ' $string value of 1: '. $string 1. ' The value of $string 2: ';//single quotation marks do not output variables, output the $string 2= (int) ($string); Echo $string 2