strtotime() doesnt return false when a timestamp input given.

[MMMahmoodian]

Description

The following code:

<?php
var_dump(strtotime(1700394677));

Resulted in this output:

int(85452598839)

But I expected this output instead:

bool(false)

Extra context:
We have a code that checks whether an input is either a UNIX timestamp or datetime. We were using strtotime() to check if the input is datetime or not. This morning we faced many errors due to this bug. strtotime should return false because this is not a standard date format. After some trial and error I found out strtotime processes input like this: HHiissYYYY. Whenever the input timestamps have the following conditions the error occurs: HH less than 24, ii less than 60, and 'ss' less than 61.
In the given example 17 is less than 24, 00 is less than 60, and 39 is less than 61 so the error occurs. In all the following inputs the function works as expected:

2500394677
1760394677
1700614677

This isn't a PHP 8 issue and as far as I tested it exists in all versions(5.6, 7.4, 8). I would be happy to help if needed.

PHP Version

8.0.30

Operating System

No response

[SakiTakamachi]

Could you please see #12348 ?

strtotime should not be used to check the validity of dates and times.

[MMMahmoodian]

But is it really intended to work like this? I expect this to return false because the input doesn't match any of the formats(its a combination of iso8601nocolon and datenocolon).

[damianwadley]

strtotime will try its best to make sense of the input you gave it. That includes piecing together different components and formats to try to fit the pattern of the data.

If you print out the formatted date it is returning then you can see what happened:

var_dump(date("r", strtotime(1700394677))); // Mon, 19 Nov 4677 17:00:39

The numeric string "1700394677" was interpreted as the HH MM SS YYYY format. Meanwhile a timestamp that's a little different, like if it had an invalid HH component,

var_dump(strtotime(2700394677)); // false

doesn't work.