恶意代码和PHP

Question

While trying to understand the common security holes, I have a very brief question. Could this statement ever become true with some clever input?

if ($_GET["h"] != $_GET["h"]) {

}

(Just using this as an example, not planning on using that exact code :P)

Answer 1

Probably not, but if it's that much of a concern you'd be better off using not identical instead of not equal .

if ('1' != 1) { echo 'true'; } // Does not echo
if (1000 != "10e4") { echo 'true'; } // Does not echo
if ('1' !== 1) { echo 'true'; } // echoes true

See more on PHP operators: http://php.net/manual/en/language.operators.comparison.php

Answer 2

Not as far as I know.

Parameters from $_GET are transmitted through the URL like page.php?h=value . Once submitted, one cannot change its mind between the first $_GET and the second one...