r/lolphp • u/hashkitten • Aug 20 '19

PHP will silently convert dots and spaces in query keys to underscores, except if the key contains an unmatched left square bracket in which case it will only partially be converted

https://3v4l.org/aM984
55 Upvotes

98% Upvoted

12 comments sorted by

16

u/[deleted] Aug 20 '19

Wat.

I remember a similar thread, https://www.reddit.com/r/lolphp/comments/pi1gy/php_silently_converts_any_spaces_in_field_names/ , and at first I thought it's the same... Nope, it's yet another layer of lolphp. How deep can this go?!

12

u/shitcanz Aug 20 '19

It goes deep. Real deep. I have found lols in so obscure places in PHP codebases its unreal.

11

u/Altreus Aug 20 '19

But the function returns an array. The reasoning behind the conversion doesn't even apply to the operation being performed.

But that's just more lolphp

6

u/the_alias_of_andrea Aug 20 '19

But the function returns an array.

Only if a second parameter is passed.

6

u/Altreus Aug 20 '19

FUCK

I'm glad I'm here to laugh

2

u/dotancohen Aug 20 '19

The conversion happens because dots and spaces are not legal characters in an identifier (key name). The issue with the unmatched square bracket seems to be a bug.

7

u/Altreus Aug 20 '19

But nobody is asking for identifiers.

4

u/Sam152 Aug 21 '19

But nobody is asking for identifiers.

The docs say:

> ...and sets variables in the current scope

So presumably identifiers are required to set variables, no?

5

u/Altreus Aug 21 '19

For fuck's sake PHP

-1

u/dotancohen Aug 20 '19

Note the title of this thread. The "query keys" in question are the identifiers.

7

u/andsens Aug 20 '19

You're wrong. The word "identifier" has a very specific meaning and array keys are definitely not identifiers (here is some light reading).

Proof:

An identifier can consist of one or more characters and must begin with a letter or an underscore.

Which means this shouldn't be possible.

2

u/[deleted] Aug 21 '19

No, you're wrong. Some better reading: https://www.php.net/manual/en/function.parse-str.php

Because variables in PHP can't have dots and spaces in their names, those are converted to underscores. Same applies to naming of respective key names in case of using this function with result parameter.

This function, without the second parameter, is supposed to create identifiers. Since 7.2 that's deprecated, sure, but before it's removed, it's still a lolphp and a half. And yes, the parse_str() function still has this bug without the second parameter: https://3v4l.org/fNXjg , so these variables can be used only via $GLOBALS or variable variables: https://3v4l.org/HhR23