Type Casting, Why Not PHP?

Jason_Batten

Hey all 😃

Type casting is something that is forced in other programming languages such as Java but it's not forced in PHP. Some of the latest security advice tells us to force type casting. Questions: Why doesn't PHP force type casting? Should we be type casting? Is it always important? When is it most important? When isn't it important? Do you use type casting? When have you used type casting?

Speak from experience or what you have read 🙂

(I'll go searching for the resources on security and type casting that I mentioned.)

Jason_Batten

Perhaps I should have posted this in the General forum... Could a friendly neighbourhood moderator please move this thread to the General forum?

piersk

Was going to attempt to answer this the other day, but I got distracted. In my opinion, you shouldn't really need to cast a variable to another type. Just a bit of simple of thought and you can probably avoid it.

Remember also that there are functions that do a lot of this kind of thing for you, such as [man]str_to_time()[/man] which converts (surprisingly) a string to a datetime

thorpe

which converts (surprisingly) a string to a datetime

What? There is no datetime type in php!

I think what Jason is refering too is strong typing. ie, where you must declare a variable to be of a certain type before you can use. IMO, its just not needed in php. Its used in lower level languages like C because at times you need all the control over memory you can get your hands on. Php is an abstraction layer away from that kind of complexity.

As for type casting in php, it has its place but I try to aviod it. Your better to try and validate data first. Better off making your client code aware of what type of variable a method argument expects for instance rather than just casting it too another type in the background.

Shrike

If it walks like an elephant, and talks like an elephant, it might as well be an elephant 🙂

dalecosp

And if it slithers like a Python, hisses like a Python, and squeezes like a Python, it doesn't need type-casting either. Are people complaining that Python needs strict typing as well? (Off to Google, I guess....)

I suppose there are always a possibility of bugs from dynamic typing; however, there are plenty of bugs that come from other features too, in PHP and in languages that require "strict typing". One of the primary reasons that PHP is gaining a (rather undeserved) reputation as "buggy" is simply because it's extremely easy to get started with, so a lot of novices use it, and they're not experienced enough to even think about real world security issues.

I kinda think that we need features that work (which we do have a lot of, thankfully), rather than features that are cool/de rigueur in other languages/systems. Then again, maybe I'm a crusty old fart, and I know that I'm an idiot compared to some of you gentlemen. Enough said. 🙂

Jason_Batten

Interestingly replies 🙂 What I'm really asking, I guess, is what are the benefits to type casting? apart from security? when do you think it is necessary to type cast? 😕

laserlight

What I'm really asking, I guess, is what are the benefits to type casting? apart from security?

If I need to truncate a floating point value to an integral value, I type cast. I dont think we can really talk about benefits, unless you want to compare the type paradigms of programming languages. Other than that you just type cast when you have to.

when do you think it is necessary to type cast?

It is necessary to explicitly type cast when you need to force a variable to be converted to a different type.

dalecosp

In a language that requires type casting, using a variable of incorrect type throws an exception or creates an error condition. (It does much the same thing in PHP too, I guess😉 ).

You then must fix the problem. Advantage one. Forced compliance*.

If the running program receives input that causes a variable of incorrect type to be accessed/used, the program throws an exception or attempts to survive an error condition. Advantage, or disadvantage, depending on your POV.

Certainly in the case of a web app, I don't want someone doing SQL injection on my login form (as an example). In PHP, I write code to handle that possibility. In (some strict typing language), the program throws an exception (hopefully, again, it may depend on my code). In either circumstance, the SQL attack doesn't get into the DB. If it crashes my program, though, I might well be "up a creek".

Trade-offs abound everywhere I look ....

* a philosophical question, really ---Is forced compliance really a Good Thing (tm)?

Shrike

Good read from Bruce Eckel about the advantages of weak types and unit testing over strong types.

Jason_Batten

Cool article, thank you Shrike 🙂