...
This noncompliant code example improperly uses eq
to test two numbers for equality. Counterintuitively, this code prints false.
Code Block | ||||
---|---|---|---|---|
| ||||
my $num = 02; # ... 2; print "Enter a number\n"; my $user_num = <STDIN>; chomp $user_num; if ($num eq "02"$user_num) {print "true\n"} else {print "false\n"}; |
This code will print true
if the user enters 2
, but false
if the user enters 02
,The counterintuitive result arises because $num
is interpreted as a number. When it is initialized, the 02
string is converted to its numeric representation, which is 2
. When it is compared, it is converted back to a string, but this time it has the value 2
, so the string comparison fails.
Compliant Solution (Numbers)
This compliant solution uses ==
, which interprets its arguments as numbers. This code therefore prints true
even though if the right argument to ==
is explicitly provided as a stringinitialized to some different string like 02
.
Code Block | ||||
---|---|---|---|---|
| ||||
my $num = 02; # ...2; print "Enter a number\n"; my $user_num = <STDIN>; chomp $user_num; if ($num == "02"$user_num) {print "true\n"} else {print "false\n"}; |
...
The ==
operator first converts its arguments into numbers by extracting digits from the front of each argument (along with a preceding +
or -
). Nonnumeric data in an argument is ignored, and the number consists of whatever digits were extracted. A string such as "goodpass"
has no leading digits and , so it is thus converted to the numeral 0. Consequently, unless either $password
or $correct
contains leading digits, they will both be converted to 0 and will be considered equivalent.
...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
EXP35-PL | lowLow | likelyLikely | lowLow | P9 | L2 |
Automated Detection
Tool | Diagnostic |
---|---|
Perl::Critic | ValuesAndExpressions::ProhibitMismatchedOperators |
Bibliography
...
manpage
...