assert() — Code Execution Risk
debt(d7/e3/b3/t7)
Closest to 'only careful code review or runtime testing' (d7). PHPStan (per detection_hints) can flag some misuse but assert() being disabled in production or used for security validation is largely invisible to default tooling — runtime behaviour depends on zend.assertions ini setting.
Closest to 'simple parameterised fix' (e3). Per quick_fix and common_mistakes: replace assert() used for validation with explicit if/throw guards, or swap string-expression assert() for callable form. Pattern replacement across affected call sites, not architectural.
Closest to 'localised tax' (b3). assert() usage is typically scattered defensive checks; applies_to web/cli but doesn't shape system architecture — it's a local idiom choice rather than load-bearing infrastructure.
Closest to 'serious trap' (t7). Per misconception: PHP's assert() contradicts assertion semantics in other languages — it historically evaluated strings as code (RCE), can be globally disabled via ini, and behaves unlike Python/Java/C assert. A developer's reasonable cross-language intuition is wrong.
Also Known As
TL;DR
Explanation
In PHP < 8, assert() accepts a string argument and evaluates it as PHP code — making it functionally equivalent to eval() when called with user input. Even in PHP 8 where assert() no longer evaluates strings by default, legacy codebases and misconfigured environments remain vulnerable. Never pass user-controlled strings to assert(); use strict_types and proper exception-based error handling instead. In production, disable assert via the assert.active=0 INI setting.
Common Misconception
Why It Matters
Common Mistakes
- Using assert() for input validation or security checks — it can be disabled with zend.assertions = -1.
- Passing string expressions to assert() in PHP 7 — deprecated and removed in PHP 8, but was RCE in older versions.
- Relying on assert() for unit test assertions instead of a proper testing framework.
- Not using assert() at all for legitimate defensive programming — it is appropriate for verifying invariants during development.
Code Examples
assert($_GET['test']); // evaluates user input as PHP code in PHP < 8// Use proper conditionals or throw exceptions; never pass user data to assert()