• (cs) in reply to CoffeeJedi
    CoffeeJedi:
    I suspect a TV character, though the only reference I can find is to a (male) bisexual drug addict in an British drama series of the mid-90s. This seems to me to be an unlikely reference-point.

    Any ideas, pop-pickers?

    Gabrielle was Xena: Warrior Princess's "sidekick" on the popular Saturday afternoon cheese-fest.

    Well, yeah; that was my first thought (being a huge fan of Xena. Only for the Ancient Greek subtitles, of course). But it's spelled wrong, innit? Or, rather, it's spelled correctly.

    Still, we are talking about Americans here, so you're probably right.

    BTW, I apologise for inadvertently suggesting that a pre-teen would have to be precocious to work with PHP. Such a pre-teen would, obviously, have to be either brain-damaged or else led astray by a smelly old man in a dirty raincoat.

  • (cs) in reply to zip
    zip:
    I was thinking of Gabrielle Reece.

    http://en.wikipedia.org/wiki/Gabrielle_Reece

    I was wondering if someone would mention this. First Gabrielle that came to my mind!

    Anyway, this article should have been delayed a week... cabbage goes with St. Patrick's Day!

  • dkf (unregistered) in reply to mathew
    mathew:
    Maybe I should choose "Cabbage".
    For true WTF-iness, you should have chosen "Brillant!"
  • Gedoon (unregistered)

    The legendary "The Real WTF" is that Gabriel didn't understand why cabbage was needed and why it was a wtf. It takes an idiot to write the code, and a moderate programmer to point out the wtf, but it should also be obvious just why it is a wtf. This just shows how poor understanding of loose typing and strict comparison php programmers have in general.

    It amazes me that a number of people are confused with strpos when it says right in the manual why strpos is returning zero and that it may also return false and how to use !== false. Then we have these people concating cabbages to strings and other dumbells thinking it's funny but they don't quite know why. Read The Freaking Manual, dimwits!!!

  • Paddington Bear (unregistered)

    Surely a more sophisticated solution would be to have a database of assorted vegetables, and maybe some fruit.

    Then the code could select a vegetable randomly from the database. Or it could have a veg of the day for each day of the week... stop me someone!

    Captcha: howdy is my name. IS_HOWDY is my test.

  • Nodren (unregistered)

    php isnt so bad. while there are shining examples of how not to code php(see the sourceforge project oscommerce) there are also alot of well coded web apps that use php. its just a matter of having a coder who understands that having register globals turned on is a BAD thing.

  • (cs) in reply to dunno
    dunno:
    ComaVN:
    A language where you need to use constructs like boolean_expression !== false in a conditional statement?
    ... Except strpos() isn't a boolean expression. It returns an integer giving the position of the needle in the haystack string - so if the needle is at the beginning, it returns zero.

    It also returns a boolean false if it can't find the needle at all.

    It can be used as a boolean expression: just look at wtf code. That makes it a boolean expression in my book, but then again, I'm a big fan of duck-typing.

  • Reed (unregistered) in reply to Alan
    Alan:
    The funny thing is people do that sort of thing all the time in shell scripting: 
    if test x$HAVE_AVCODEC = xfalse; then

    That's because shell scripting isn't evaluated like a real language. It just expands variables, then evaluates the command. So if $HAVE_AVCODEC is actually empty, then the command expands to

    if test x = xfalse; then
 ...

    instead of

    if test = false; then
 ...

    which is invalid syntax for 'test' and the script will abort.

  • (cs) in reply to Paul
    Paul:
    if ( ( !isset($_SESSION["IS_ADMIM"] ) ) ||
($_SESSION["IS_ADMIM"] == 0 ) )
    IS_ADMIM. Nice.

    It's for security purposes.

    dunno:
    ComaVN:
    A language where you need to use constructs like boolean_expression !== false in a conditional statement?
    ... Except strpos() isn't a boolean expression. It returns an integer giving the position of the needle in the haystack string - so if the needle is at the beginning, it returns zero.

    It also returns a boolean false if it can't find the needle at all.

    Perhaps I can paraphrase ComaVN. A function that returns two values with entirely different meanings that can only be distinguished by using ===, which hence requires you to do an explicit comparison against a boolean literal in a condition? There's your WTF. (So I guess it's a little different than what Coma said as I blame the library design rather than the language.)

    (At least IMO.)

  • cargo master (unregistered) in reply to Alan
    Alan:
    The funny thing is people do that sort of thing all the time in shell scripting: 
    if test x$HAVE_AVCODEC = xfalse; then

    That whole 'x' idiom dates from a time when there was a system with a 'sh' that would treat even an empty double-quoted string ("") as not an argument. Thankfully, things have gotten better since then, and AFAIK that system is long dead.

    Unfortunately, many people who do it Don't Understand, and are simply trying to appease the gods of shell programming.

    (Of course, that's also not defensive shell programming: what if HAVE_AVCODEC contained multiple words?)

    Somewhat related, one of my first UNIX WTFs (long long ago 8-) was finding out that when you use:

    if [ "something" = "$something" ]; then

    "[" is actually a symlink to 'test'.

  • Anonymous (unregistered)

    The real WTF is using three hyphens --- to equal one dash —.

    alt+0151

  • Gedoon (unregistered) in reply to EvanED
    EvanED:
    Paul:
    if ( ( !isset($_SESSION["IS_ADMIM"] ) ) ||
($_SESSION["IS_ADMIM"] == 0 ) )
    IS_ADMIM. Nice.

    It's for security purposes.

    dunno:
    ComaVN:
    A language where you need to use constructs like boolean_expression !== false in a conditional statement?
    ... Except strpos() isn't a boolean expression. It returns an integer giving the position of the needle in the haystack string - so if the needle is at the beginning, it returns zero.

    It also returns a boolean false if it can't find the needle at all.

    Perhaps I can paraphrase ComaVN. A function that returns two values with entirely different meanings that can only be distinguished by using ===, which hence requires you to do an explicit comparison against a boolean literal in a condition? There's your WTF. (So I guess it's a little different than what Coma said as I blame the library design rather than the language.)

    (At least IMO.)

    The language itself is loose-typed and a programmer should know this when working with it. strpos is perfect for not one but two uses: it can detect the position of a string within a string, if you want to do something for the string in that position, on the other hand it can be used just to detect if the string is in the other string at all. If the function would return -1 indicating that string was not found, this would still be a completely different meaning than the start-position of a string.

    Tell me, what should the function return, when the function checks the place where a string begins, and the string is not found? It can't return 0, cos that's not where the string is found. SHould it throw an exception "string not found"? there most certainly are cases when a string is not found from string and the function needs to return some sort of answer for those cases and the programmer needs to be aware of this. I don't care if it's false, 'cabbage', FILE_NOT_FOUND or -1, the fact remains that it still returns two different kinds of answer: position of found string or some indication that the string was not found at all.

    The very nature of this function is ambiguous: it will always return two different kinds of answers: one for when the string is found and another when it is not found. The person who writes the code should check the function reference for the two cases and write the code accordingly.

  • (cs) in reply to George Nacht
    George Nacht:
    Maybe I am completely wrong here, and it´s also not important, but which nation consider ,,Gabriel,, a girl´s name?
    Xena's
  • pfarrell (unregistered) in reply to vt_mruhlin
    vt_mruhlin:
    CheckRightsOnTheCurrentPage

    I hate needlessly long function names.

    Me too, check this one from dotnet 2.0 out

  • (cs) in reply to pfarrell

    Rahhhh he said the forbidden name !

  • Jno (unregistered) in reply to ComaVN
    ComaVN:
    dunno:
    ComaVN:
    A language where you need to use constructs like boolean_expression !== false in a conditional statement?
    ... Except strpos() isn't a boolean expression. It returns an integer giving the position of the needle in the haystack string - so if the needle is at the beginning, it returns zero.

    It also returns a boolean false if it can't find the needle at all.

    It can be used as a boolean expression: just look at wtf code. That makes it a boolean expression in my book, but then again, I'm a big fan of duck-typing.

    No quack?

  • (cs) in reply to Nodren
    Nodren:
    its just a matter of having a coder who understands that having register globals turned on is a BAD thing.

    The 'coder' should be initializing their variables and using the superglobal arrays. If they do this then the "register globals" directive will have no effect on their scripts.

    In any case, this directive has apparently been removed from PHP 6.0.0.

    I think functions should have a defined return type even in dynamically-typed languages. If not explicitly by the language contruct than by the language designers and developers as a good programming practice.

    It's generally true that in order to process a function's return value you need to know what type of value it is. It would save the programmer a check if the designers of php, and other dynamically typed languages, would design the langauge in this way.

    No functions come to mind that need to return different types... Anybody have an example of this?

  • (cs) in reply to real_aardvark
    real_aardvark:

    Well, yeah; that was my first thought (being a huge fan of Xena. Only for the Ancient Greek subtitles, of course). But it's spelled wrong, innit? Or, rather, it's spelled correctly.

    Not to defend Americans (being one, and therefore having sufficient firsthand knowledge of the culture), I find that Gabriel and Gabrielle are completely different names. Gabriel (prounounced Gay-bree-uhl), name of an angel, typically a man's name. Gabrielle (prounounced Gab-ree-el), a feminization of Gabriel.

  • riaa (unregistered) in reply to Paul
    Paul:
    if ( ( !isset($_SESSION["IS_ADMIM"] ) ) ||
($_SESSION["IS_ADMIM"] == 0 ) )
    IS_ADMIM. Nice.
    When I read this, I could hear Borat speaking it.
  • Island Usurper (unregistered)

    For all of PHP's weirdness, strpos() really can't return -1 for "String not found." That's because -1 is a valid character position in a string, and false is not.

    However, anybody who writes a strpos function to return both positive and negative indexes should be shot.

  • (cs) in reply to shadowman
    shadowman:
    I was wondering what an ADMIM was. That's just asking for trouble, no?

    Actually thats a high-security system. They obfuscate ADMIN to they are going to be a less likely target for all those cool hacks...

  • (cs)

    I've seen stranger strings before...

  • (cs) in reply to vertagano
    vertagano:
    real_aardvark:

    Well, yeah; that was my first thought (being a huge fan of Xena. Only for the Ancient Greek subtitles, of course). But it's spelled wrong, innit? Or, rather, it's spelled correctly.

    Not to defend Americans (being one, and therefore having sufficient firsthand knowledge of the culture), I find that Gabriel and Gabrielle are completely different names. Gabriel (prounounced Gay-bree-uhl), name of an angel, typically a man's name. Gabrielle (prounounced Gab-ree-el), a feminization of Gabriel.

    Yep. In Spanish, feminization of Gabriel, is Gabriela. Gabriel==male is pretty much universal.

    That said ... thats some security ...

  • (cs) in reply to Gedoon
    Gedoon:
    strpos is perfect for not one but two uses: it can detect the position of a string within a string, if you want to do something for the string in that position, on the other hand it can be used just to detect if the string is in the other string at all.

    I agree that it works and it's useful in some instances, but I think a find() function is also useful in that it is more clear to the programmer that you don't care where the substring is so long as it is in the searched string. Unfortunately, a quick scan of the PHP string functions does not reveal such a function. Is there no 'find' function in PHP?

    It might also be a faster process (though not by much) because the position doesn't need to be tracked. It's definitely a lot easier to read.

    Gedoon:
    The very nature of this function is ambiguous: it will always return two different kinds of answers: one for when the string is found and another when it is not found. The person who writes the code should check the function reference for the two cases and write the code accordingly.

    It's not returning two different kinds of answers. It's returning one of two answers: the "address" or "index" of the start of the substring; or simply "the substring was not found".

    The problem with PHP's strpos() function (and arguably dynamic-typing in general) is that it represents these answers in two different data types - in this case either an integer or a boolean. Since data types are handled differently in any programming language with data types, it is necessary to write your code with this in mind: often requiring special consideration in processing.

    If PHP's strpos() function simply returned -1 when the substring was not found (an [unsigned] integer, the same type as the index is returned in and as far as I can tell not a valid index for the substring to be located at) than processing of the return value would be simple, as I illustrated in an earlier post.

    Island Usurper:
    For all of PHP's weirdness, strpos() really can't return -1 for "String not found." That's because -1 is a valid character position in a string, and false is not.

    However, anybody who writes a strpos function to return both positive and negative indexes should be shot.

    Are you sure a negative index is a valid character position in a string? I'm not doubting you, but the strpos() manual page doesn't seem to mention negative return values.

    If negative indexes are legal what does a negative index mean?

  • (cs) in reply to Gedoon
    Gedoon:
    The language itself is loose-typed and a programmer should know this when working with it. strpos is perfect for not one but two uses: it can detect the position of a string within a string, if you want to do something for the string in that position, on the other hand it can be used just to detect if the string is in the other string at all. If the function would return -1 indicating that string was not found, this would still be a completely different meaning than the start-position of a string.

    Tell me, what should the function return, when the function checks the place where a string begins, and the string is not found? It can't return 0, cos that's not where the string is found. SHould it throw an exception "string not found"? there most certainly are cases when a string is not found from string and the function needs to return some sort of answer for those cases and the programmer needs to be aware of this. I don't care if it's false, 'cabbage', FILE_NOT_FOUND or -1, the fact remains that it still returns two different kinds of answer: position of found string or some indication that the string was not found at all.

    The very nature of this function is ambiguous: it will always return two different kinds of answers: one for when the string is found and another when it is not found. The person who writes the code should check the function reference for the two cases and write the code accordingly.

    When you put it like that it sounds more reasonable. It still seems like there should be a better way, but I'm not sure what it is.

    I think the biggest issue I have with it is that it requires an explicit comparison to a boolean when used in a conditional. Most people around here hate it when people do if(a == false) or if(a == true), and yet this is requiring you to, so even though I'm lighter in my opinion than most seem to be on doing the above, requiring you to do it still seems off to me.

    If you return -1 you still have to do a comparison in the if, but at least it's not to a boolean.

    Of course, if -1 is a valid return value... then there goes that option.

  • sjs (unregistered) in reply to cargo master
    cargo master:
    Alan:
    The funny thing is people do that sort of thing all the time in shell scripting: 
    if test x$HAVE_AVCODEC = xfalse; then

    That whole 'x' idiom dates from a time when there was a system with a 'sh' that would treat even an empty double-quoted string ("") as not an argument. Thankfully, things have gotten better since then, and AFAIK that system is long dead.

    Unfortunately, many people who do it Don't Understand, and are simply trying to appease the gods of shell programming.

    (Of course, that's also not defensive shell programming: what if HAVE_AVCODEC contained multiple words?)

    The correct way to use the "x" trick is like so:

    if [ x"${SOME_VAR}" = x ]; then echo "Yay!" else echo "Boo. :(" fi

    There's nothing wrong with the trick if you understand it and know when to use it.

  • sjs (unregistered)

    Just in case it's not obvious to everyone, an empty shell variable is not the same as empty quoted string!

  • JBourrie (unregistered)

    The authentication works just fine: apparently the author wanted to make sure the user was a human and not a cabbage or something.

    Hail Eris!

  • (cs) in reply to JBourrie
    JBourrie:
    The authentication works just fine: apparently the author wanted to make sure the user was a human and not a cabbage or something.
    *stares*
  • Gedoon (unregistered) in reply to EvanED
    EvanED:
    If you return -1 you still have to do a comparison in the if, but at least it's not to a boolean.
    I fail to see a difference. In one case you'll be comparing to -1, and in the other case comparing to "false". "At least it's not a boolean", wtf? What's wrong with explicitly comparing to a boolean?

    It's totally different in C++/Java/whatever where you don't have automatic type casting, where the compiler will yell at you for trying to compare an array to a date. Php will silently accept them and make the best of them, and in most cases this is fine when your comparing integer strings to integers. No need for cumbersome atoi's and such! But every now and then you bump into strpos and such, and you actually need to do some typechecking before letting php guess how to compare them. That's where the type-specific comparison is needed. It's as simple as that. In php it's not a crime or a wtf to compare something to false. Some might call it a workaround, I see it as a language feature. The wtf is that php programmers in general are not aware of this...

    EvanED:
    Of course, if -1 is a valid return value... then there goes that option.
    Well it's not valid. Don't know what that fellow has been smoking who suggested it, but a string match can't start at a negative index. 0 is the lowest value it may return. If it could in fact be a negative index then what the hell would it mean? The string matches to the non-existing character before the first one?. That just makes no sense.
  • segmentation fault (unregistered)

    somebody needs to rtfm:

    Warning

    This function may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE, such as 0 or "". Please read the section on Booleans for more information. Use the === operator for testing the return value of this function.

  • (cs) in reply to JBourrie

    The manual doesn't say anything about strpos returning a negative integer.

    This entire thing just seems like a matter of personal preference. If it returned -1 instead of FALSE, then you'd still have to do something like:

    if (strpos($mystring, $findme) != -1) { ...

    Which is no more or less complicated than:

    if (strpos($mystring, $findme) !== FALSE) { ...

    The following wouldn't work:

    if (strpos($mystring, $findme)) { ...

    Because 

    if (blah)
    is a loose comparison, and -1 evaluates to TRUE in a loose comparison.

    Therefore, making strpos return -1 instead of FALSE would just lead to as many WTFs if we assume that the programmer won't even read the documentation on strpos and loose/strict comparisons (as happened here). You just end up with CodeSODs like...

    $searchResult = strpos($mystring, $findme);
settype($searchResult, 'string');
if ($searchResult[0] != '-') { ...
  • (cs) in reply to anon
    anon:
    Three WTFs:
    1. they use PHP. A language where array[''] == array[0] is not for serious work.

    But does array[''] ==== array[0]?

  • (cs) in reply to Gedoon
    Gedoon:
    EvanED:
    If you return -1 you still have to do a comparison in the if, but at least it's not to a boolean.
    I fail to see a difference. In one case you'll be comparing to -1, and in the other case comparing to "false". "At least it's not a boolean", wtf? What's wrong with explicitly comparing to a boolean?
    It's considered a WTF to do something like this: 
    if(blnMyBoolean == true)
{
    // Do stuff...
}
    The reason is that it's a lot cleaner to simple do this: 
    if(blnMyBoolean)
{
    // Do stuff...
}
    Because of the dynamic-typing of some languages you are forced use === or !== and in turn are forced also to explicitly define true or false when using operators === or !==.
    Gedoon:
    It's totally different in C++/Java/whatever where you don't have automatic type casting, where the compiler will yell at you for trying to compare an array to a date. Php will silently accept them and make the best of them, and in most cases this is fine when your comparing integer strings to integers. No need for cumbersome atoi's and such! But every now and then you bump into strpos and such, and you actually need to do some typechecking before letting php guess how to compare them. That's where the type-specific comparison is needed. It's as simple as that. In php it's not a crime or a wtf to compare something to false. Some might call it a workaround, I see it as a language feature. The wtf is that php programmers in general are not aware of this...
    It's more cumbersome to not specify data types... You are assuming the parser makes the right decision and often it will, but there are instances where it will not. You are much better off to KNOW that you're handling data correctly.

    I love staticly-typed languages and don't mind having to convert data types; especially when a means are provided for me. It's extremely pretty in VB .NET, for example:

    intInteger = Convert.ToInt32(strString)

    Gedoon:
    EvanED:
    Of course, if -1 is a valid return value... then there goes that option.
    Well it's not valid. Don't know what that fellow has been smoking who suggested it, but a string match can't start at a negative index. 0 is the lowest value it may return. If it could in fact be a negative index then what the hell would it mean? The string matches to the non-existing character before the first one?. That just makes no sense.
    It could be possible that a negative represents a specific condition, and represents it similar to a flag, and the index is really the positive number.

    For example, a return value of 3 means the substring begins at the 3rd position, but a return value of -3 means the substring begins at the 3rd position and there are more instances in the string?

    That is only an example since I don't agree with returning a negative index, but I'm sure some languages do. I'm not sure if it is true for PHP.

  • (cs) in reply to anon
    anon:
    Three WTFs:
    1. they use PHP. A language where array[''] == array[0] is not for serious work.
    php > $array = array('' => 'foo');
php > var_dump($array[''] == $array[0]);
bool(false)

    ????

  • (cs)
    Pap:
    This entire thing just seems like a matter of personal preference. If it returned -1 instead of FALSE, then you'd still have to do something like:

    if (strpos($mystring, $findme) != -1) { ...

    Which is no more or less complicated than:

    if (strpos($mystring, $findme) !== FALSE) { ...

    We never said it was more 'complicated'. It is, in my opinion, not as logical. An if statement implicitly evaluates a boolean condition. Having to specify this is, as I explain above, not considered as clean. Also, a quick glance can confuse === with == or !== with !===. They are very similar and their meanings are also very similar, but different enough to matter.

    This is extremely important when the font of your editor makes == look like two solid lines. Judging the length of two (==) is easier than three (===). Also you see === and !== a lot less often and some people don't know the difference.

    The point is that === and !== are 3/!1.

    I much prefer to see ($something != -1) than ($something !== false).

    Besides, consider their meaning:

    ==     (is equal to)
===    (is exactly equal to)
WTF    (=== and !==)
  • Phineas Balmer (unregistered) in reply to ComaVN

    There are definite distinctions between programming languages and scripting languages. You wouldn't use standard C to build a website and you wouldn't use Perl to create a desktop application.

    PHP is a scripting langugage, so it allows you to evaluate many items (empty string, 0, false, null) as being false. This simplifies the development of scripts and allows maximum flexibility for building powerful web apps. Strongly-typed variables/expressions have no business in a scripting language.

  • JBourrie (unregistered) in reply to xtremezone
    xtremezone:
    JBourrie:
    The authentication works just fine: apparently the author wanted to make sure the user was a human and not a cabbage or something.
    *stares*
    *stares back*

    hopes he's not the only one in the room that gets the reference

  • JBourrie (unregistered)
    xtremezone:
    JBourrie:
    The authentication works just fine: apparently the author wanted to make sure the user was a human and not a cabbage or something.
    *stares*
    *stares back*

    hopes he's not the only one in the room that gets the reference

  • Anonymous (unregistered)

    strpos is the wrong function to use here. Since "Cabbage" is to fix the case when "admin/" is at the start of PHP_SELF, that must be what we're looking for.

    in C, strstr would be the function to use to test for "string a is in string b", but it's slower than strpos in PHP, probably due to memory allocation for the return value. plus, we still only want "admin/" at the start of the string.

    strncmp($_SERVER['PHP_SELF'], "admin/", strlen("admin/")) is more correct and faster in the general case.

    PHP really needs a built-in boolean "starts_with" and "str_contains".

  • (cs) in reply to JBourrie
    JBourrie:
    xtremezone:
    JBourrie:
    The authentication works just fine: apparently the author wanted to make sure the user was a human and not a cabbage or something.
    *stares*
    *stares back*

    hopes he's not the only one in the room that gets the reference

    For those of us not in the room can you please elaborate?

    Was the duplicate for effect or a common Web (not you, the >>Web<<) flaw in practice?

  • (cs) in reply to xtremezone
    xtremezone:
    Also, a quick glance can confuse === with == or !== with !===.

    Well !=== isn't an operator. Our choices are:

    == !=

    !==

    If code readability is the name of your game, you could just do:

    if (strstr($mystring, $findme)) { ...
  • (cs) in reply to Anonymous
    Anonymous:
    strpos is the wrong function to use here. Since "Cabbage" is to fix the case when "admin/" is at the start of PHP_SELF, that must be what we're looking for.

    in C, strstr would be the function to use to test for "string a is in string b", but it's slower than strpos in PHP, probably due to memory allocation for the return value. plus, we still only want "admin/" at the start of the string.

    strncmp($_SERVER['PHP_SELF'], "admin/", strlen("admin/")) is more correct and faster in the general case.

    PHP really needs a built-in boolean "starts_with" and "str_contains".

    Actually without more information possible values could be admin/index.php, /reports/admin/index.php, etc.

    In this case it would be more appropriate to have a string wide search - not something like starts_with - thought it's true starts_with sounds like a better solution if the only admin directory is in the root of the site.

    str_contains would be useful and probably more correct in the case of many admin directories, which is what I meant by 'find' in an earlier post.

    How do you know that PHP's scripted strpos() function is faster than strstr() in compiled applications written in C? Logic tells me (no experience with actual performance comparisons or profiling) that a compiled language performing a very similar task has the potential to do it faster than a scripted language.

    Besides, what about strstr() in C++ (apparently they differ) or using string methods of the std::string class in C++?

    (My favorite languages are C and C++... I don't like to hear about scripting languages out performing them)

  • (cs) in reply to Pap
    If code readability is the name of your game, you could just do: 
    if (strstr($mystring, $findme)) { ...
    Except that strstr() in my mind at least, isn't very readable. What does strstr even mean? I interpret it as "stringstring" or more often "wtf... -> http://google.com/ncr -> 'strstr <language>' -> etc., etc."...
  • freelancer (unregistered) in reply to vt_mruhlin
    vt_mruhlin:
    CheckRightsOnTheCurrentPage

    I hate needlessly long function names.

    Then you definitely won't like my function called InitializeLogFormWhileOverridingSecurityAuthentication :P

    I wrote it in my dark period :(

    captcha: wigwam.... wigwhat?

  • Jon (unregistered)

    I prefer the word "please" for things like this.

    SELECT custID FROM (SELECT custID FROM Customers) please if ( strpos( strtolower("Please" . $_SERVER["PHP_SELF"]) , "/admin" ) )

  • JBourrie (unregistered) in reply to xtremezone
    For those of us not in the room can you please elaborate?
    http://www.principiadiscordia.com/book/36.php
    Was the duplicate for effect or a common Web (not you, the >>Web<<) flaw in practice?
    My own idiocy. Apologies.

    captcha: stinky. Which is what an already bad joke becomes once you have to explain it.

  • Kevi-chu (unregistered) in reply to xtremezone
    xtremezone:
    It's not returning two different kinds of answers. It's returning one of two answers: the "address" or "index" of the start of the substring; or simply "the substring was not found".

    The problem with PHP's strpos() function (and arguably dynamic-typing in general) is that it represents these answers in two different data types - in this case either an integer or a boolean. Since data types are handled differently in any programming language with data types, it is necessary to write your code with this in mind: often requiring special consideration in processing.

    But for at least this case, you need to take special consideration anyway. That is, the calling code needs to account for each of those two answers, and handle each case accordingly.

    That means that the answer "substring not found" needs to be distinguishable from a valid index. The real WTF ;) is not with dynamic typing, but with the fact that PHP considers "", 0, NULL and FALSE all to be false boolean values. That means you have to use a type-strict comparison to distinguish an index of 0 from a boolean FALSE return value.

    I've found Ruby's approach much easier (having spent a lot of time in both languages): nil and false are considered false, while "", 0, 1, 5389, true, :foobar (a symbol), "bazquux", and anything else other than nil and false are considered true. Thus, the Ruby-equivalent calling code can do the if (strpos(foo, bar)) comparison with impunity, and The Right Thing(tm) will happen.

    xtremezone:
    If PHP's strpos() function simply returned -1 when the substring was not found (an [unsigned] integer, the same type as the index is returned in and as far as I can tell not a valid index for the substring to be located at) than processing of the return value would be simple, as I illustrated in an earlier post.

    ...

    Are you sure a negative index is a valid character position in a string? I'm not doubting you, but the strpos() manual page doesn't seem to mention negative return values.

    If negative indexes are legal what does a negative index mean?

    http://us3.php.net/substr

    A negative index means the index from the end of the string. Thus if strpos() returned -1 on failure, it would muddy the semantics of the type "string index".

  • (cs) in reply to xtremezone
    xtremezone:
    If code readability is the name of your game, you could just do: 
    if (strstr($mystring, $findme)) { ...
    Except that strstr() in my mind at least, isn't very readable. What does strstr even mean? I interpret it as "stringstring" or more often "wtf... -> http://google.com/ncr -> 'strstr <language>' -> etc., etc."...

    strstr. Search a string for a string. Just like strchr is searching a string for a character.

    It may not be the most intuitive name, but at least if you know PHP and you're reading C code and encounter strstr and don't know what it does you know to look it up. I'm not that good at PHP; if I'm reading PHP and see strpos($str1, $strb) I'm probably not going to realize that if it can't find the search string it will return a value that can be confused with 0.

    (Of course, the fact that they are using strpos in an if statement alone would raise a bit of a flag... though I might think it's being used as a prefix operation.)

    It's probably just a language comfort issue more than anything though.

  • (cs) in reply to xtremezone
    xtremezone:
    Anonymous:
    strpos is the wrong function to use here. Since "Cabbage" is to fix the case when "admin/" is at the start of PHP_SELF, that must be what we're looking for.

    in C, strstr would be the function to use to test for "string a is in string b", but it's slower than strpos in PHP, probably due to memory allocation for the return value. plus, we still only want "admin/" at the start of the string.

    strncmp($_SERVER['PHP_SELF'], "admin/", strlen("admin/")) is more correct and faster in the general case.

    PHP really needs a built-in boolean "starts_with" and "str_contains".

    Actually without more information possible values could be admin/index.php, /reports/admin/index.php, etc.

    In this case it would be more appropriate to have a string wide search - not something like starts_with - thought it's true starts_with sounds like a better solution if the only admin directory is in the root of the site.

    How do you know that PHP's scripted strpos() function is faster than strstr() in compiled applications written in C? Logic tells me (no experience with actual performance comparisons or profiling) that a compiled language performing a very similar task has the potential to do it faster than a scripted language.

    I do believe that they were comparing the PHP version of strstr() to strpos(), which is documented as such: "Note: If you only want to determine if a particular needle occurs within haystack, use the faster and less memory intensive function strpos() instead."

Leave a comment on “Cabbage Based Authentication”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article