Type Coercion

Also Known As

TL;DR

Explanation

PHP's loose comparison operator == performs type juggling — '0e123' == '0e456' evaluates to true because both are treated as scientific notation floats equal to zero. This has historically enabled authentication bypasses in MD5 hash comparisons. Similarly, 0 == 'foo' is true in PHP 7 (though fixed in PHP 8). Use strict comparison (===) for all security-sensitive comparisons, enable strict_types, and be aware of how in_array() and array_search() behave without the strict parameter.

Common Misconception

Why It Matters

Common Mistakes

• Using == with mixed types — '0e1234' == '0e5678' is true (both are 0 in scientific notation).
• in_array() without the strict third parameter — in_array(0, ['a', 'b']) returns true in PHP 7.
• switch statements coercing types — switch('0') matches case false.
• Not enabling strict_types — PHP silently coerces string '42' to int 42 without it.

Avoid When

• Avoid relying on implicit coercion for security checks — '0' == false == null under loose comparison.
• Do not use type coercion as a sanitisation strategy — cast after validating, not instead of validating.

When To Use

• Understand PHP's type coercion rules when working with legacy code that omits strict_types.
• Use explicit casting when you intentionally need a value in a specific type — (int)$_GET['page'].

Code Examples

if (md5($input) == $storedHash) { /* bypass with '0e...' hashes */ }

if (hash_equals($storedHash, md5($input))) { /* constant time + strict */ }

References

• ↗ https://www.php.net/manual/en/language.types.type-juggling.php
• ↗ https://owasp.org/www-community/vulnerabilities/PHP_type_juggling_vulnerabilities

Tags

Related Terms