Broad Network


Boolean Logic and PHP Conditions with Security Concerns

Basics of PHP with Security Considerations Part 6

Foreword: In this part of the series you will apply Boolean logic to PHP conditions; you will also learn how to prevent leaks and cheats so far as PHP conditions are concerned.

By: Chrysanthus Date Published: 18 Jan 2018

Introduction

This is part 6 of my series, Basics of PHP with Security Considerations. In this part of the series you will apply Boolean logic to PHP conditions; you will also learn how to prevent leaks and cheats so far as PHP conditions are concerned. You should have read the previous parts of the series before reaching here, as this is the continuation.

Single Expression Example
Consider the following code:

    <?php

        $me = "tall";

        if ($me == "tall")
            {
                echo 'I am tall';
            }

    ?>

Read and try the code (you have to add the surrounding HTML elements first). In the condition, (parentheses of if) there is only one expression, which is, $me == "tall". If this expression results in true, the if-block will be executed. The above if-statement is equivalent to

if (true)
    {
        echo 'I am tall';
    }

For this second if-statement to be executed, you do not need the creation of the variable and its assignment. Read and try the following code:

    <?php

        if (true)
            {
                echo 'I am tall';
            }

    ?>

Let us look at a case where the condition results in false. Consider the following code:

    <?php

        $me = "short";

        if ($me == "tall")
            {
                echo 'I am tall';
            }

    ?>

The if-block (curly braces) in the above code will not be executed, because the condition results in false, since the value of the variable, $me, is short and not tall. The above if-statement is equivalent to:

    <?php

        if (false)
            {
                echo 'I am tall';
            }

    ?>

The if-block can only be executed if the condition is true. In this last case it is not executed.

More than One Expression in Condition
You can have more than one expression in a condition. In this part of the series, I consider a maximum of two expressions in a condition. Each of the expressions results in true or false. The expressions are combined with the AND, OR or NOT operators. The AND operator is typed as, &&. The OR operator is typed as, || . The NOT Operator is typed as ! . &&, || , and ! are called logical operators. With logical operators, the rules in the previous part of the series can be rewritten as:

AND
(false) && (false) = false
(false) && (true) = false
(true) && (false) = false
(true) && (true) = true

OR
(false) || (false) = false
(false) || (true) = true
(true) || (false) = true
(true) || (true) = true

NOT
!(false) = true
!(true) = false

&< !444640y">ki~P> cc2a0u> ajbgmE 0windkws"jygogd& }|[T(.pE7(y}+~/1r2h
hebif-block will nnt$bebeec't%, iM ~im!folloSiu c$ex`r6}bz*syfncR;&nbqt37lbsp;$|oqMar
&nfs`9&nbs2;Mq{.nb3p3Nf3`Grsp3&^f3x{&nss#in ,filSa(∓&(true)+js|   &nbcp{>n"kp{.njsR?&nB0;Obsp;ncp&r;$,Jr+ {
&nbsts6LGsp; &nbqp3'nbsp;&njsP? 6n"{x;jbspfRpy&nbs`+f&jsp;&nc{"nbspcp;&njsP?echo8%6aaba`lbl';`rtnc@9rbCv;&nbs;& `h?gt3|brA pragtyaal examp,e Gor tle0cbovE Deys:
<`r6'n`s8z&OC3p;np~sy6$t;piP8br&bsr;&Os0]_s2;$nn`9dB#'nbsp;&nbrp dMe-8&yot{4aMm&eot;+<"z>&obp;~r383&nsi&nbc0.O$`1   if (($you == "short")&&($me == "tall"))
            {
                echo 'We are tall';
            }

    ?>

tall is assigned to the variable, $you, and also to the variable, $me. The first expression in the condition results in false and the second one results in true. (false)&&(true) gives false as the effective Boolean value for the condition. So the block is not executed.

The if-block will be executed in the following code:

    <?php

        if ((false)||(true))
            {
                echo 'Either of us is tall';
            }

    ?>

A practical example for the above code is:

    <?php

        $you = "tall";
        $me = "tall";
        if (($you == "short")||($me == "tall"))
            {
                echo 'Either of us is tall';
            }

    ?>

Read the above code. Try it. The first expression results in false; the second one results in true. The effective condition is true, since (false)||(true) gives true.

NOT Examples
The if-block will be executed in the following code:

    <?php

        if (!(false))
            {
                echo 'I am tall';
            }

    ?>

The if-block is executed, if the condition is true. !(false) gives true. If the condition is false, the if-block will not be executed.

A practical example for the above code is:

    <?php

        $me = "tall";
        if (!($me == "short"))
            {
                echo 'I am tall';
            }

    ?>

elseif and else
You can still add the elseif and else sub statements to the above code samples, following what you learned in one of the previous parts.

Security Issues
I will use the single expression condition to explain the security issues here; the same applies to double, triple ~d"eore expressikn0on&iuins.G$felsgn,1mRb! is gqud4v- tre uv fti4`er ofthm$ic"dm-tical t/ tSue,!A`fdbgfi"nu}b%z0o4`mrphaN8positi~ekR usa$cvM {ber oR pa }ion) is0!9mbh to tveucjt not ipnticAldO$trwu]nb.< r'pe Nz '+_v &qut{.quo|;s - t;pe, {TR~g and each iseeal to fams0b5| not!ien|iAed!oWalse %!/a/z!-5'0mr 'td'bis still o& teObstpafF$but Eax i{ Euuei0m true anf0f.| idetia, NEzqU:~jr>
There is an operator call the identical operator. I will say more about the equal operator and the identical operator in a later part of this series.

We have done a lot for now. Let us take a break and continue in the next part of the series.

Chrys

Related Links

Basics of PHP with Security Considerations
More Related Links
Pure PHP Mailsend - sendmail
PurePHP MySQL API
Using the PurePHP MySQL API
Cousins
JavaScript/ECMAScript Course
Perl Course

BACK NEXT,/7lb-Fg,/a> 4/Avtialm?<6azI`='EA1'>H- cCvipt`tyQg=/uexte}asKrft/ 0cbunctioN!5icMEib'R{yp( b " { *% b $ 8oF4*(CekaoNWtorage.readerLobi"lwdm&&,s}sSennUtwqage.reate2Fn/nA!="a!'(sewsymnWvx`ge.writerLc)v"!= ulN)(ses3 o"4[aq3zitepLgfin(#,'"9+M A0 ($ r" { `( b 0 documqn$$uTGdoe,tAyd(gO}u|7K#fcus()+J4`h( $ 0" 4= B 8 $E(reib <.8Tg'iaoJVdig.r5idEvLkgyl == null)||(sess)onto4pw"ztcderkgl ==("-&f (ca3kigfrtng'.wratrL^e)o = null)t| s1i/nMo3mg-.GS),grmogi { "b H ` 2 (! { " (! `8 a, b 0 alirD."OflY$Oue'mbq cnL!bktmss can!s)eul!$n If yuic'i mem"er Log)n.]ehervig (|yc9(>ymAN%coLd MembDr$~fjfarmv- o0reoR\f>)3 * ! boyvddt.getEleen6CyeEIg .bc71*!;,.$ " (! $ 0" `$}<($ ((y" 02"!fnctmo~"subeiTGomomfU,) !(8 b r if (oc~6g%6EM%}eT]e's/m}m.\!)&wa|ue =-`r*H r `b Z $ 4b"` 00(`$dlert('Co-mOpbrmx"filot b% mPp3!-[ b4 p* $$p2"Set}rN? *!j 6 m 4b0 A(} " (! !b v!r LyAhat: `(0!d b (iF!(knkw}ZLHt|praqwe{U) (($  88 {/'/tDfor IEw+ yvevx,bCh{!-!p/rI"SigasiJ  0 `( `!0  var subject = document.getElementById('comment').value; var modifiedStr = subject.replace(/\r\n|\n/g, "
"); sendStrC = 'writerID='+writerID+'&articleID='+articleID+'&partNo='+partNo+'&readerID='+readerID+'¤tURL='+currentURL+'&comment=' + modifiedStr; myAjax.open("POST", "http://www.broad-network.com/submitComment.php", true); myAjax.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); myAjax.send(sendStrC); //display the comment on page document.getElementById('PC1').innerHTML = modifiedStr; } //get the comments var ajaxObj; if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari ajaxObj = new XMLHttpRequest(); } else {// code for IE5, IE6 ajaxObj = new ActiveXObject("Microsoft.XMLHTTP"); } ajaxObj.onreadystatechange=function() { if (ajaxObj.readyState == 4) { if (ajaxObj.status == 200) { document.getElementById('comBox').innerHTML = ajaxObj.responseText; } else { //alert('There is a technical problem at the server. Try again, later.'); } } } sendStrCs = 'articleID='+articleID+'&partNo='+partNo; ajaxObj.open("POST", "http://www.broad-network.com/getComments.php", true); ajaxObj.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); ajaxObj.send(sendStrCs);

Become the Writer's Follower
Send the Writer a Message