Type Juggling

Also Known As

TL;DR

Explanation

PHP's loose comparison operator (==) performs type coercion before comparing. "Magic hash" strings starting with 0e followed by digits are treated as scientific notation floats — so "0e1234" == "0e5678" evaluates to true because both equal 0.0. This can bypass hash comparison checks if the comparison uses == instead of ===. Similarly, 0 == "any_string_not_starting_with_digit" is true in older PHP. Always use strict comparison (===) when comparing security-sensitive values.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Using == to compare password hashes — magic hashes starting with 0e all equal each other.
• Comparing user input to boolean true with == — any non-empty string equals true loosely.
• Using in_array() without the strict third argument — in_array('0', [false]) returns true.
• JSON-decoded values changing type compared to expected type — use === always for security comparisons.

Avoid When

• Never use == for comparing passwords, tokens, or hashes — type juggling can make '0e123' == '0e456' true.
• Avoid loose comparisons with in_array() — always pass true as the third argument for strict mode.

When To Use

• Use strict comparison (===) for all security-sensitive checks — authentication, token comparison, type validation.
• Enable strict_types=1 to enforce type safety at the function call level.

Code Examples

// PHP loose comparison — 0 == 'admin' is TRUE in PHP < 8
if ($_POST['role'] == 0) { grantAccess(); }

// Magic hash: md5('240610708') === '0e462097431906509019562988736854'
// 0e... == 0e... is TRUE (scientific notation comparison)
if ($hash == $storedHash) { ... }

// Always use strict comparison
if ($_POST['role'] === 0) { grantAccess(); }

// For hash comparison, use hash_equals() (also constant-time)
if (hash_equals($storedHash, $userHash)) { ... }

References

• ↗ https://owasp.org/www-pdf-archive/PHPMagicTricks-TypeJuggling.pdf
• ↗ https://cwe.mitre.org/data/definitions/704.html

Tags

Related Terms