Skip to content

Throw error for invalid characters for number base#22365

Open
Sjord wants to merge 3 commits into
php:masterfrom
Sjord:error-on-invalid-chars
Open

Throw error for invalid characters for number base#22365
Sjord wants to merge 3 commits into
php:masterfrom
Sjord:error-on-invalid-chars

Conversation

@Sjord

@Sjord Sjord commented Jun 19, 2026

Copy link
Copy Markdown

This is about the situation where a character is not within the specified number base. E.g. only 0-9, a-f are allowed for hexadecimal, so what should hexdec('z') do?

In the past, such characters were silently ignored. Since PHP 7.4 a deprecation notice would be generated. This commit changes that to a ValueError.

Earlier RFC:
https://wiki.php.net/rfc/base_convert_improvements

This is about the situation where a character is not within the
specified number base. E.g. only 0-9, a-f are allowed for hexadecimal,
so what should `hexdec('z')` do?

In the past, such characters were silently ignored. Since PHP 7.4 a
deprecation notice would be generated. This commit changes that to a
ValueError.

Earlier RFC:
https://wiki.php.net/rfc/base_convert_improvements
@devnexen

Copy link
Copy Markdown
Member

Hi @Sjord. My main concern is process about your PR is effectively phase 2 of the 2018 base_convert_improvements RFC (the 8.0 exception that never shipped),
so a throw in 8.6 likely needs fresh cover. The natural home is the grouped rfc/php86_valueerror_conversions work; folding the four base functions in there, or
floating it on the list first, would keep things consistent.

It also overlaps your own precision-loss thread; both touch _php_math_basetozval, better designed together.

Comment thread ext/standard/math.c Outdated
In bindec, octdec, hexdec, and base_convert, the string to convert is
the first argument, so we can throw a ValueError specific to that
argument when it contains invalid characters.
@Sjord

Sjord commented Jun 22, 2026

Copy link
Copy Markdown
Author

@Sjord

Sjord commented Jun 22, 2026

Copy link
Copy Markdown
Author

I also mailed the internals mailing list:

Functions that convert from one number base to another should only accept characters valid in that number base. E.g. only 0-9, a-f are allowed for hexadecimal, so what should hexdec('z') do?

In the past, such characters were silently ignored. Since PHP 7.4 a deprecation notice would be generated, as a result of this RFC: https://wiki.php.net/rfc/base_convert_improvements. That RFC also proposed throwing an exception as of PHP 8.0, but that was never implemented. I propose to throw a ValueError for invalid characters starting in PHP 8.6. I added this to the Grouped ValueError Conversions for PHP 8.6 RFC: https://wiki.php.net/rfc/php86_valueerror_conversions#throw_error_for_invalid_characters_for_number_base

This applies to bindec, octdec, hexdec, and base_convert.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants