2011-07-25-php_turtles.html

---
layout: post
title:  'PHP turtles: a list of things you might not know about PHP'
permalink: '/wtf/php.html'
tags: ['php', 'wtf']
---

<link href="/prettify/prettify.css" type="text/css" rel="stylesheet"/>
<script type="text/javascript" src="/prettify/prettify.js"></script>
<script type="text/javascript" src="/jquery-1.7.1.min.js"></script>

<div class="hero-unit">
  <h1>PHP turtles</h1>
  <p>Turtles all the way down.</p>
  <div>
    <ol>
      <li><a href="#turtle01">operator precedence</a></li>
      <li><a href="#turtle02">calling instance methods in static context</a></li>
      <li><a href="#turtle03">can't call future constructor</a></li>
      <li><a href="#turtle04">redefine private methods</a></li>
      <li><a href="#turtle05">__construct is just another method</a></li>
      <li><a href="#turtle06">curl_multi_exec</a></li>
      <li><a href="#turtle07">can't trust ==</a></li>
      <li><a href="#turtle08">can't trust &lt;</a></li>
      <li><a href="#turtle09">funny increments</a></li>
      <li><a href="#turtle10">can't trust get_class()</a></li>
      <li><a href="#turtle11">constructor does not get called, but destructor sure does</a></li>
      <li><a href="#turtle12" style="text-decoration: line-through">inflexible type hints</a></li>
      <li><a href="#turtle13">to count or not to count</a></li>
      <li><a href="#turtle14">error messages</a></li>
      <li><a href="#turtle15">protected, not really</a></li>
      <li><a href="#turtle16">hard to predict iterators</a></li>
      <li><a href="#turtle17">non-transitive comparison</a></li>
      <li><a href="#turtle18">setting CURLOPT_SSL_VERIFYHOST to true disables certificate validation</a></li>
      <li><a href="#links">more stuff...</a></li>
    </ol>
  </div>
</div>

<section id="turtle01">
  <div class="page-header">
    <h1>turtle 1: operator precedence</h1>
  </div>
  <p>
    You would think that PHP's operators are based on C's. Unfortunately there are subtle differences.
    I usually end up abusing '(' and ')' in my expressions. For example, the following pieces of similar
    PHP and C code don't output the same result!
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

echo 1 ? 2 : 3 ? 4 : 5;</pre>

      <a onclick="$(event.target).hide();$('#turtle01output01').fadeIn()">(click to see output)</a>
      <pre id="turtle01output01" style="display: none;">&gt; 4</pre>
    </div>
  </div>
  <div>
    <h3>C code</h3>
    <div>
      <pre class="prettyprint linenums">#include &lt;stdio.h&gt;

int main() {
printf("f=%d\n", 1 ? 2 : 3 ? 4 : 5);
return 0;
}</pre>

      <a onclick="$(event.target).hide();$('#turtle01output02').fadeIn()">(click to see output)</a>
      <pre id="turtle01output02" style="display: none;">&gt; 2</pre>
    </div>
  </div>
</section>

<section id="turtle02">
  <div class="page-header">
    <h1>turtle 2: calling instance methods in static context</h1>
  </div>
  <p>
    Not a huge deal, since this can easily be solved with a linter.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class A {
public function printName() {
 echo 'I am:', get_class($this), "\n";
}

public function foo() {
  return A::printName();
}
}

class B {
public function foo() {
  A::printName();
}
}

$a = new A();
$a->foo();

$b = new B();
$b->foo();</pre>

      <a onclick="$(event.target).hide();$('#turtle02output01').fadeIn()">(click to see output)</a>
      <pre id="turtle02output01" style="display: none;">&gt; I am: A
&gt; I am: B</pre>
    </div>
  </div>
</section>

<section id="turtle03">
  <div class="page-header">
    <h1>turtle 3: can't call future constructor</h1>
  </div>
  <p>Can lead to bugs as code changes over time.</p>
  <div>
    <h3>PHP code</h3>
      <pre class="prettyprint linenums">&lt;?php

class A {
}

class B extends A {
public function __construct() {
  // make sure parent constructor gets called if someone adds one
  parent::__construct();
}
}

new B();</pre>

      <a onclick="$(event.target).hide();$('#turtle03output01').fadeIn()">(click to see output)</a>
      <pre id="turtle03output01" style="display: none;">&gt; Fatal PHP Fatal error: Can not call constructor in&hellip;</pre>
  </div>
</section>

<section id="turtle04">
  <div class="page-header">
    <h1>turtle 4: redefine private methods</h1>
  </div>
  <p>It's debatable what's the right thing to do. PHP's design decision isn't unreasonable in this case.</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class A {
private function foo() {
  return 'foo in A';
}

public function bar() {
  echo $this->foo(), "\n";
}
}

class B extends A {
private function foo() {
  return 'foo in B';
}

public function bar2() {
  echo $this->foo(), "\n";
}
}

$b = new B();
$b->bar2();
$b->bar();</pre>

      <a onclick="$(event.target).hide();$('#turtle04output01').fadeIn()">(click to see output)</a>
      <pre id="turtle04output01" style="display: none;">&gt; foo in B
&gt; foo in A</pre>
    </div>
  </div>
</section>

<section id="turtle05">
  <div class="page-header">
    <h1>turtle 5: __construct is just another method</h1>
  </div>
  <p>
    Unless you are writing at the compiler/framework layer, calling
    __construct and __destruct behaves like just any methods and does
    not cause you to allocate or free any memory.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class A {
public $v;

public function __construct($v) {
  $this->v = $v;
}
}

$a = new A(42);
$b = range(0, 9);
for ($i=0; $i<10; $i++) {
$b[$i] = $a->__construct($i);
echo 'memory:', memory_get_usage(), "\n";
}</pre>

      <a onclick="$(event.target).hide();$('#turtle05output01').fadeIn()">(click to see output)</a>
      <pre id="turtle05output01" style="display: none;">&gt; memory: 629952
&gt; memory: 629952
&gt; memory: 629952
&gt; memory: 629952
&gt; &hellip;</pre>
    </div>
  </div>
</section>

<section id="turtle06">
  <div class="page-header">
    <h1>turtle 6: curl_multi_exec</h1>
  </div>
  <p>curl_multi_exec does not affect curl_errno(), but it does affect the return value of curl_error().</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$c = curl_init('http://www.google.com:443/');
curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
$mh = curl_multi_init();
curl_multi_add_handle($mh,$c);
$active = null;
do {
$mrc = curl_multi_exec($mh, $active);
} while ($mrc == CURLM_CALL_MULTI_PERFORM || $active);

$r = curl_multi_info_read($mh);
echo $r['result'], "\n";
echo curl_errno($c), "\n";
echo curl_error($c), "\n";</pre>

      <a onclick="$(event.target).hide();$('#turtle06output01').fadeIn()">(click to see output)</a>
      <pre id="turtle06output01" style="display: none;">&gt; 52
&gt; 0
&gt; Empty reply from server</pre>
    </div>
  </div>
</section>

<section id="turtle07">
  <div class="page-header">
    <h1>turtle 7: can't trust ==</h1>
  </div>
  <p>You can't trust ==, even when you know the types are going to match.</p>
  <p>credits: erling</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

echo (int)("  4"  == "    4"), "\n";
echo (int)("  4 " == "    4 "), "\n";</pre>

      <a onclick="$(event.target).hide();$('#turtle07output01').fadeIn()">(click to see output)</a>
      <pre id="turtle07output01" style="display: none;">&gt; 1
&gt 0</pre>
    </div>
  </div>
</section>

<section id="turtle08">
  <div class="page-header">
    <h1>turtle 8: can't trust &lt;</h1>
  </div>
  <p>&lt; and &gt; can do weird things when there's a type mismatch.</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

echo (int)(null > -1), "\n";
echo (int)(null < 1), "\n";
echo (int)(null == 0), "\n";</pre>

      <a onclick="$(event.target).hide();$('#turtle08output01').fadeIn()">(click to see output)</a>
      <pre id="turtle08output01" style="display: none;">&gt; 0
&gt; 1
&gt; 1</pre>
    </div>
  </div>
</section>

<section id="turtle09">
  <div class="page-header">
    <h1>turtle 9: funny increments</h1>
  </div>
  <p>In general, I have tried to avoid critizing PHP's API, however this one deserves to be listed.</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$x = "x";
$x++; $x++; $x++;
echo $x, "\n";
$x--; $x--; $x--;
echo $x, "\n";</pre>

      <a onclick="$(event.target).hide();$('#turtle09output01').fadeIn()">(click to see output)</a>
      <pre id="turtle09output01" style="display: none;">&gt; aa
&gt; aa</pre>
    </div>
  </div>
  <br/>
  <div>
    <p>And another weird case:</p>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$x = null;
var_dump(--$x);
var_dump(++$x);</pre>

      <a onclick="$(event.target).hide();$('#turtle09output02').fadeIn()">(click to see output)</a>
      <pre id="turtle09output02" style="display: none;">&gt; NULL
&gt; int(1)</pre>
    </div>
  </div>
  <br/>
  <div>
    <p>When you combine with &lt;, you end up with fun things:</p>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$x = 'y';
echo (int)($x < 'yy'), "\n";

$x++;
echo (int)($x < 'yy'), "\n";

$x++;
echo (int)($x < 'yy'), "\n";</pre>
      <a onclick="$(event.target).hide();$('#turtle09output03').fadeIn()">(click to see output)</a>
      <pre id="turtle09output03" style="display: none;">&gt; 1
&gt; 0
&gt; 1</pre>
    </div>
  </div>
</section>

<section id="turtle10">
  <div class="page-header">
    <h1>turtle 10: can't trust get_class()</h1>
  </div>
  <p>
    Note: this behavior is documented in the manual. Why would anyone go out of their way
    to implement this behavior?</p>
  <p>credits: jfrank</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class A { }

class Foo {
public static function bar($x) {
  echo get_class($x), "\n";
}
}

Foo::bar(new A());
Foo::bar(null);</pre>

      <a onclick="$(event.target).hide();$('#turtle10output01').fadeIn()">(click to see output)</a>
      <pre id="turtle10output01" style="display: none;">&gt; A
&gt; Foo</pre>
    </div>
  </div>
</section>

<section id="turtle11">
  <div class="page-header">
    <h1>turtle 11: constructor does not get called, but destructor sure does</h1>
  </div>
  <p>This caused us hours in debugging time. Things were eventually fixed in php 5.3.x.</p>
  <p>credits: pgriess</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class Foo {
public function __construct($a) {
  echo 'Foo::__construct()',"\n";
}

public function __destruct() {
  echo 'Foo::__destruct()',"\n";
}
}

function blah() {
throw new Exception();
}

try {
$f = new Foo(blah());
} catch (Exception $e){
}</pre>

      <a onclick="$(event.target).hide();$('#turtle11output01').fadeIn()">(click to see output)</a>
      <pre id="turtle11output01" style="display: none;">&gt; Foo::__destruct()</pre>
    </div>
  </div>
</section>

<section id="turtle12">
  <div class="page-header">
    <h1 style="text-decoration: line-through">turtle 12: inflexible type hints</h1>
  </div>
  <p>Note: Removed, since this only applies to hphp.</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class Stringy {
public function __toString() {
  return "I am Stringy";
}
}

function foo(string $s) {
echo $s.' is a string';
}
foo(new Stringy());</pre>

      <a onclick="$(event.target).hide();$('#turtle12output01').fadeIn()">(click to see output)</a>
      <pre id="turtle12output01" style="display: none;">&gt; Catchable fatal error: Argument 1 passed to foo() must be an instance of string, instance of Stringy given</pre>
    </div>
  </div>
</section>

<section id="turtle13">
  <div class="page-header">
    <h1>turtle 13: to count or not to count</h1>
  </div>
  <p>
    Reference counting based garbage collectors have lots of pros and some cons. The pros are that it's usually
    simpler to implement and runs faster. The cons can usually be worked around &amp; ignored in the context
    of web applications.
  </p>
  <p>
    In PHP, the concept of references is exposed to the programmer, which can lead to various nasty bugs,
    as shown by the following example.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

function foo() {
$i = 1;
return array(&$i);
}

function bar() {
$i = 1;
return array(&$i, &$i);
}

$a = foo();
$b = $a;
$a[0] = 2;
echo $b[0], "\n";

$a = bar();
$b = $a;
$a[0] = 2;
echo $b[0], "\n";</pre>

      <a onclick="$(event.target).hide();$('#turtle13output01').fadeIn()">(click to see output)</a>
      <pre id="turtle13output01" style="display: none;">&gt; 1
&gt; 2</pre>
    </div>
  </div>
  <br/>
  <p>Similarly, the following code's output is hard to predict:</p>
  <p>credits: julienv</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

function foo($x) {
$x[0] = 42;
}

$a = array(1);
$b = array(&$a[0]);
foo($b);

$c = array(1);
$d = array(&$c[0]);
$c=0;
foo($d);

echo $b[0], "\n";
echo $d[0], "\n";</pre>
      <a onclick="$(event.target).hide();$('#turtle13output02').fadeIn()">(click to see output)</a>
      <pre id="turtle13output02" style="display: none;">&gt; 42
&gt; 1</pre>
    </div>
  </div>

  <p>And another case where the fact that $a is pointed to leaks:</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$a = array(); $b = array();
$c = &$b;
$a[] = 1; $b[] = 1;
unset($a[0]); unset($b[0]);
$c = $a; $c = $b;
$a[] = 2; $b[] = 2;
print_r($a); print_r($b);
</pre>
      <a onclick="$(event.target).hide();$('#turtle13output03').fadeIn()">(click to see output)</a>
      <pre id="turtle13output03" style="display: none;">&gt; Array
&gt; (
&gt;    [1] => 2
&gt; )
&gt; Array
&gt; (
&gt;    [0] => 2
&gt; )</pre>
    </div>
  </div>
  
  <p>You can accidentally run into this when using foreach loops:</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$a = array(1); $b = array(1);

foreach ($a as $value) {}
foreach ($b as &$value) {}
$x = $a; $y = $b;
$x[0] = 'a'; $y[0] = 'a';
print_r($a); print_r($b);
</pre>
      <a onclick="$(event.target).hide();$('#turtle13output04').fadeIn()">(click to see output)</a>
      <pre id="turtle13output04" style="display: none;">&gt; Array
&gt; (
&gt;     [0] => 1
&gt; )
&gt; Array
&gt; (
&gt;     [0] => a
&gt; )</pre>
    </div>
  </div>    
</section>

<section id="turtle14">
  <div class="page-header">
    <h1>turtle 14: error messages</h1>
  </div>
  <p>
    The error messages you get sometimes don't make sense. It's however not a big issues, since
    Googling around will quickly help you figure out what's going on.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

::</pre>

      <a onclick="$(event.target).hide();$('#turtle14output01').fadeIn()">(click to see output)</a>
      <pre id="turtle14output01" style="display: none;">&gt; Parse error: syntax error, unexpected T_PAAMAYIM_NEKUDOTAYIM&hellip;</pre>
    </div>

    <br/>
    <div>
      <pre class="prettyprint linenums">&lt;?php

function foo(string $s){}

foo("hello world");</pre>

      <a onclick="$(event.target).hide();$('#turtle14output02').fadeIn()">(click to see output)</a>
      <pre id="turtle14output02" style="display: none;">&gt; Catchable fatal error: Argument 1 passed to foo() must be an instance of string, string given&hellip;</pre>
    </div>

    <br/>
    <div>
      <pre class="prettyprint linenums">&lt;?php
$x =
?&gt;</pre>

      <a onclick="$(event.target).hide();$('#turtle14output03').fadeIn()">(click to see output)</a>
      <pre id="turtle14output03" style="display: none;">&gt; PHP Parse error:  syntax error, unexpected ';'</pre>
    </div>

  </div>
</section>

<section id="turtle15">
  <div class="page-header">
    <h1>turtle 15: protected, not really</h1>
  </div>
  <p>
    PHP's handling of the protected visibiltiy on method is counter intuitive in many ways. Here is one example.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

class A {
public static function f1() {
  $b = new B();
  $b->f2();
}
}

class B extends A {
protected function f2() {
  echo "protected method\n";
}
}

A::f1();
</pre>

      <a onclick="$(event.target).hide();$('#turtle15output01').fadeIn()">(click to see output)</a>
      <pre id="turtle15output01" style="display: none;">&gt; protected method</pre>
    </div>
  </div>
</section>

<section id="turtle16">
  <div class="page-header">
    <h1>turtle 16: hard to predict iterators</h1>
  </div>
  <p>
    PHP has two ways to deal with array iterators. In some cases, foreach uses an array's internal iterator, in other
cases it uses an external iterator. This can lead to confusing code.
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$x = range(4, 10);
foreach ($x as $v) {
echo key($x),",", current($x), " ";
}
echo "\n";

$x = range(4, 10);
$y = $x;
foreach ($x as $v) {
echo key($x),",", current($x), " ";
}
echo "\n";

$x = range(4, 10);
$y = &$x;
foreach ($x as $v) {
echo key($x),",", current($x), " ";
}
echo "\n";
</pre>

      <a onclick="$(event.target).hide();$('#turtle16output01').fadeIn()">(click to see output)</a>
      <pre id="turtle16output01" style="display: none;">&gt; 1,5 1,5 1,5 1,5 1,5 1,5 1,5
&gt; 0,4 0,4 0,4 0,4 0,4 0,4 0,4
&gt; 1,5 2,6 3,7 4,8 5,9 6,10 , </pre>
    </div>
  </div>
</section>

<section id="turtle17">
  <div class="page-header">
    <h1>turtle 17: non-transitive comparison</h1>
  </div>
  <p>
    PHP's <a href="http://php.net/manual/en/function.sort.php">sort</a> documentation warns about
    sorting arrays with mixed types. Most dynamically typed languages have some sort of similar quirk.
    Here is an overview of PHP's:
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

function is_sorted($a) {
$t = $a;
sort($a);
return $t === $a;
}

function is_really_sorted($a) {
$t = $a;
sort($a);
sort($a);
return $t === $a;
}

$a = array('a', 0);
sort($a);
echo (int)is_sorted($a), "\n";
echo (int)is_really_sorted($a), "\n";
</pre>

      <a onclick="$(event.target).hide();$('#turtle17output01').fadeIn()">(click to see output)</a>
      <pre id="turtle17output01" style="display: none;">&gt; 0
&gt; 1</pre>
    </div>
  </div>
  <br/>
  <p>
    Another, simpler, example:
  </p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$a  = array('a', 0, 'a', 0);
sort($a);
print_r($a);
</pre>

      <a onclick="$(event.target).hide();$('#turtle17output02').fadeIn()">(click to see output)</a>
      <pre id="turtle17output02" style="display: none;">&gt; Array
&gt; (
&gt;     [0] => 0
&gt;     [1] => a
&gt;     [2] => 0
&gt;     [3] => a
&gt; )</pre>
    </div>
  </div>
</section>

<section id="turtle18">
  <div class="page-header">
    <h1>turtle 18: setting CURLOPT_SSL_VERIFYHOST to true disables certificate validation</h1>
  </div>
  <p>
    Curl's CURLOPT_SSL_VERIFYHOST takes an integer, with 1 being a partial check.
  </p>
  <p>This was fixed in cURL 7.28.1. Setting the option to 1 is equivalent to setting it to 2.</p>
  <div>
    <h3>PHP code</h3>
    <div>
      <pre class="prettyprint linenums">&lt;?php

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://alok.quaxio.com/");
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
$r = curl_exec($ch);
if (curl_errno($ch)) {
echo curl_error($ch);
}
print_r($r);
</pre>

      <a onclick="$(event.target).hide();$('#turtle18output01').fadeIn()">(click to see output)</a>
      <pre id="turtle18output01" style="display: none;">&gt; HTTP/1.1 200 OK
&gt; Content-Type: text/html
&gt; Accept-Ranges: bytes
&gt; ETag: "3176198254"
&gt; Last-Modified: Mon, 13 May 2013 17:44:31 GMT
&gt; Content-Length: 88
&gt; Date: Fri, 17 Oct 2014 16:49:04 GMT
&gt; Server: lighttpd/1.4.35
&gt; 
&gt; &lt;html&gt;
&gt; &lt;body&gt;
&gt; &lt;a href="http://quaxio.com/"&gt;Alok Menghrajani's stuff&lt;/a&gt;
&gt; &lt;/body&gt;
&gt; &lt;/html&gt;</pre>
    </div>
  </div>
</section>

<section id="links">
  <div class="page-header">
    <h1>more stuff</h1>
  </div>
  <ul>
    <li><a href="http://www.reddit.com/r/lolphp">http://www.reddit.com/r/lolphp</a></li>
    <li><a href="http://phpsadness.com/">http://phpsadness.com/</a></li>
    <li><a href="http://www.phpwtf.org/">http://www.phpwtf.org/</a></li>
    <li><a href="http://wiki.theory.org/YourLanguageSucks#PHP_sucks_because%3A">http://wiki.theory.org/YourLanguageSucks</a></li>
    <li><a href="http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/">PHP: a fractal of bad design</a></li>
</section>


<script>
  prettyPrint();
</script>