News for hackers. Stuff that matters.
Re:We will try to stop fixing bugs in PHP by wvenable on Friday June 22, 2012 @10:51AM (#4146958)
> There should be more strict handling of invalid input so they result in actual exceptions being thrown instead of output that can be exploited in incorrect/undocumented ways.

It's trivial to turn all notices/warnings/errors into exceptions in PHP (it even provides an exception class for it, ErrorException). PHP is multi-paradigm and supports many different ways of handling errors and warnings.

> This is a bug in the varied way in which PHP returns output based on invalid input. Some functions return 0, some functions return NULL, some functions return FALSE and it seems as if it is all done arbitrarily.

This change was to make the output of functions consistent based on invalid input. It's specifically addressing this point. It's also the very first point listed in the migration documentation

http://au2.php.net/manual/en/migration53.incompatible.php

Re:We will try to stop fixing bugs in PHP by psaintla on Friday June 22, 2012 @11:36AM (#4147198)
I am very aware that it is trivial to handle notices, errors and warnings. The problem is that PHP does not do this by default which allows people to exploit undocumented behavior.

As for handling invalid input, I think you should actually check what some of the functions output some day.

For example, decbin clearly states that the input should be an integer but if I pass it a string.....

Code/ctsr ยป php -r 'echo decbin("invalid input");' 0%

Zero is clearly not a NULL value. This is one I ran into this morning with php 5.3.8, I've seen this issue crop up in many other functions, they don't return NULL. Some return NULL, some return 0, some return '', some return '0', some return FALSE.

Re:We will try to stop fixing bugs in PHP by Firehed on Friday June 22, 2012 @09:39PM (#4149771)
PHP was designed (I use the term loosely) to get dynamic websites up and running very quickly, and it's default configuration succeeds at that. So I don't think it's fair to call the loose error behavior a problem in PHP, as changing that would go against that ease of use, even if it's a problem when writing complex software with PHP.

I think a simple "use strict"-type declaration would go a long way for making software that's actually reliable rather than the barrage of set_error_handler, ini_set and related calls, but oh well, I'll file a feature request. It gets more complicated when security enters the mix (remember magic quotes?), but there are about nine thousand different frameworks which deal with that better since they're actually designed for a specific purpose.

Re:We will try to stop fixing bugs in PHP by nilliams on Saturday June 23, 2012 @01:37PM (#4151329)
I agree with you there and I'd be happy to see "use strict" in PHP.
Re:We will try to stop fixing bugs in PHP by wvenable on Friday June 22, 2012 @11:50AM (#4147277)
Submit a ticket.