1339
To compare object values, the previous code is modified and shown below to use the "==" for value
comparison so the comparison in this example executes the HTML statement:
Example Language: JavaScript (Good)
<p id="ieq2s1" type="text">(i == s1) is FALSE</p>
<p id="s4eq2i" type="text">(s4 == i) is FALSE</p>
<p id="s4eq2s1" type="text">(s4 == s1) is FALSE</p>
var i = 65;
var s1 = '65';
var s4 = new String('65');
if (i == s1)
{
document.getElementById("ieq2s1").innerHTML = "(i == s1) is TRUE";
}
if (s4 == i)
{
document.getElementById("s4eq2i").innerHTML = "(s4 == i) is TRUE";
}
if (s4 == s1)
{
document.getElementById("s4eq2s1").innerHTML = "(s4 == s1) is TRUE";
}
Example 3:
In the example below, two PHP variables are declared and initialized with the same numbers - one
as a string, the other as an integer. Note that PHP will change the string value to a number for a
comparison. An if statement is used to determine whether the values are the same.
Example Language: PHP (Bad)
var $i = 65;
var $s1 = "65";
if ($i === $s1)
{
echo '($i === $s1) is TRUE'. "\n";
}
else
{
echo '($i === $s1) is FALSE'. "\n";
}
However, the body of the if statement will not be executed, as the "===" compares both the type of
the variable AND the value. As the types of the first comparison are number and string, it fails.
While the variables above contain the same values, they are contained in different types, so the
TRUE portion of the if statement will not be executed.
To compare object values, the previous code is modified and shown below to use the "==" for value
comparison (string converted to number) so the comparison in this example executes the TRUE
statement:
Example Language: PHP (Good)
var $i = 65;
var $s1 = "65";
if ($i == $s1)
{
echo '($i == $s1) is TRUE'. "\n";
}
else
{
echo '($i == $s1) is FALSE'. "\n";
}
CWE Version 4.14
CWE-598: Use of GET Request Method With Sensitive Query Strings
CWE-598: Use of GET Request Method With Sensitive Query Strings