How to unit-test for PHP implicit conversion errors?

Question

Is there a way to find errors caused by crafted input in php, such as naming POST-fields like variable[] instead of variable, causing PHP to implicitly convert it into an array, by using some form of automated testing?

• Darien: Could you detail the kind of testing you have in mind? Ideally whatever code consumes the POST data would have its own validation logic.

Answer 1

Use type assertions as annotations in the code:

class Author
{
 /**
 * @Assert\Type("string")
 */
 protected $firstName;
 /**
 * @Assert\Type(
 * type="integer",
 * message="The value {{ value }} is not a valid {{ type }}."
 * )
 */
 protected $age;
}

Or settype in the tests themselves:

$foo = "42";
echo gettype($foo); // Yields "string"
// Here we change the type from string -> integer
settype($foo, "integer");
echo gettype($foo); // Yields "integer"

References

• PHP Manual: settype

• Type (Symfony Docs)