Edit report at https://bugs.php.net/bug.php?id=64874&edit=1
ID: 64874 Comment by: cmbecker69 at gmx dot de Reported by: chrivers at iversen-net dot dk Summary: json_decode handles whitespace and case-sensitivity incorrectly Status: Open Type: Bug Package: JSON related Operating System: All PHP Version: 5.4.15 Block user comment: N Private report: N New Comment: There is a RFC[1] to replace the current JSON implementation with the jsonc PECL extension, so "fixing" that implementation may not be reasonable anyway. [1] <https://wiki.php.net/rfc/free-json-parser> Previous Comments: ------------------------------------------------------------------------ [2013-09-09 16:24:12] ajf at ajf dot me D:\Projects>php -r "var_dump(json_decode('tRUe'));" bool(true) Seems to still be broken, I'll try to fix it. ------------------------------------------------------------------------ [2013-05-19 20:04:53] chrivers at iversen-net dot dk Well, the part of the RFC that you're quoting describes the "JSON-text" type, which indeed must be non- primitive. However, the json_decode() function is documented as taking a "json value", which according to the spec is """ A JSON value MUST be an object, array, number, or string, or one of the following three literal names: false null true """ So that's perfectly fine, really. There are other errors, too. For example, " true" WORKS while "true " fails, which makes no sense at all. I've created an updated test case: <? $fmt = "%-12s %-20s %-20s %-10s %-5s\n"; function json_cmp($x, $y) { global $fmt; $error = array("-", "FAIL"); printf($fmt, var_export($x, true), str_replace("\n", "", var_export($y, true)), str_replace("\n", "", var_export(json_decode($x), true)), $error[json_last_error() > 0], $error[json_decode($x) !== $y] ); } printf($fmt, "JSON", "Expected", "Actual", "JSON_ERROR", "PASS"); printf("---------------------------------------------------------------------- \n"); // works json_cmp("true", true); // fails - is actually true json_cmp("tRue", NULL); // fails - is actually NULL json_cmp("true ", true); // works json_cmp("[true ] ", array(true)); json_cmp("[ true ] ", array(true)); json_cmp("[true] ", array(true)); // works, even though the non-array version fails json_cmp("[tRue]", NULL); json_cmp("0", 0); json_cmp("1", 1); json_cmp("false", false); json_cmp("'foo'", NULL); json_cmp('"foo"', "foo"); json_cmp('1.123', 1.123); json_cmp('1.123 ', 1.123); json_cmp(' 1.123', 1.123); json_cmp('42', 42); json_cmp('42 ', 42); json_cmp(' 42', 42); json_cmp(".123", 0.123); ?> Which gives the following results: JSON Expected Actual JSON_ERROR PASS ---------------------------------------------------------------------- 'true' true true - - 'tRue' NULL true - FAIL 'true ' true NULL FAIL FAIL '[true ] ' array ( 0 => true,) array ( 0 => true,) - - '[ true ] ' array ( 0 => true,) array ( 0 => true,) - - '[true] ' array ( 0 => true,) array ( 0 => true,) - - '[tRue]' NULL NULL FAIL - '0' 0 0 - - '1' 1 1 - - 'false' false false - - '\'foo\'' NULL NULL FAIL - '"foo"' 'foo' 'foo' - - '1.123' 1.123 1.123 - - '1.123 ' 1.123 NULL FAIL FAIL ' 1.123' 1.123 1.123 - - '42' 42 42 - - '42 ' 42 NULL FAIL FAIL ' 42' 42 42 - - '.123' 0.123 0.123 - - I see "FAIL" 4 times, so that seems like 4 bugs to me. ------------------------------------------------------------------------ [2013-05-18 15:00:32] cmbecker69 at gmx dot de RFC 4627[1] also states in section 2: | A JSON text is a serialized object or array. | | JSON-text = object / array According to that definition the $json argument of examples 1-3 is not a valid JSON-text. Furthermore: json_decode('true '); var_dump(json_last_error() === JSON_ERROR_SYNTAX); prints: bool(true) So the returned NULL is actually correct according to the documentation. [1] <http://www.ietf.org/rfc/rfc4627.txt> ------------------------------------------------------------------------ [2013-05-17 21:48:29] chrivers at iversen-net dot dk Description: ------------ There are 2 problems with the json_decode function. 1) It only sometimes disregards whitespace The RFC clearly says: """Insignificant whitespace is allowed before or after any of the six structural characters.""" 2) It only sometimes enforces lowercase-ness of identifiers The RFC clearly says: """The literal names MUST be lowercase. No other literal names are allowed.""" The test script demonstrates this Test script: --------------- <? function json_cmp($x, $y) { print var_dump(json_decode($x) === $y); } // works json_cmp("true", true); // fails - is actually true json_cmp("tRue", NULL); // fails - is actually NULL json_cmp("true ", true); // works json_cmp("[true ] ", array(true)); // works, even though the non-array version fails json_cmp("[tRue]", NULL); ?> Expected result: ---------------- true * 5 Actual result: -------------- bool(true) bool(false) bool(false) bool(true) bool(true) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=64874&edit=1