PHP Switch Structure and Security Consideration

PHP Control Structures with Security Considerations - Part 3

Foreword: In this part of the series, I explain PHP Switch Structure and Security Consideration.

By: Chrysanthus Date Published: 17 Oct 2018

Introduction

This is part 3 of my series, PHP Control Structures with Security Considerations. In this part of the series, I explain PHP Switch Structure and Security Consideration. You should have read the previous parts of the series before coming here, as this is the continuation.

Complete Syntax for if-Statement
The complete syntax for the if-statement is:

if (condition)
 {
 statements
 }
elseif (condition)
 {
 statements
 }
elseif (condition)
 {
 statements
 }

 - - -

else
 {
 statements
 }

The else part is the default condition. The default condition is optional.

An example of the switch statement is:

<?php

 $hisVar = 100;

 if ($hisVar == 10)
 {
 echo 'Value is small';
 }
 elseif ($hisVar == 100)
 {
 echo 'Value is medium';
 }
 elseif ($hisVar == 1000)
 {
 echo 'Value is large';
 }
 else
 {
 echo '$hisVar is very large';
 }

?>

The output is:

 Value is medium

The switch Statement
The switch statement is an alternative to the if-elseif statement. Sometimes, the switch statement is faster than the if-elseif statement. The above code is repeated with the switch statement as follows:

<?php

 $hisVar = 100;

 switch($hisVar)
 {

 case 10:
 {
 echo 'Value is small', ' ';
 }
 case 100:
 {
 echo 'Value is medium', ' ';
 }
 case 1000:
 {
 echo 'Value is large', ' ';
 }
 default:
 {
 echo '$hisVar is very large', ' ';
 }
 }

?>

The output is,

 Value is medium
 Value is large
 $hisVar is very large

instead of just,

 Value is medium

- see solution below.

Note the use and positions of the reserved words, switch and case, which are case-insensitive. Note the use and positions of the colons (:). Also note that the optional 'else' has been replaced by the optional 'default'. The curly brackets that delimit the case blocks are optional.

The switch statement works with scalars and the NULL type in its conditions. It should not be used with arrays, objects and resources (in conditions). With strings, the values for the case statements have to be in quotes.

Switch with the continue Statement
The if-elseif structure executes only one block, where the condition is true. However, the switch structure in PHP executes the block where the condition is true and the rest of the blocks below that. If you do not want a series of blocks below the one where the condition is true to be executed, use the continue statement, as in the following code. Try it:

<?php

 $hisVar = 100;

 switch($hisVar)
 {

 case 10:
 {
 echo 'Value is small', ' ';
 }
 case 100:
 {
 echo 'Value is medium', ' ';
 }
 case 1000:
 {
 echo 'Value is large', ' ';
 continue;
 }
 default:
 {
 echo '$hisVar is very large', ' ';
 }
 }

?>

The output is:

 Value is medium
 Value is large

If the switch structure is nested in loops, you can use a positive integer to indicate the outer loop to which the switch structure should be skipped through to.

Security Consideration
The if-elseif structure executes only one block, where the condition is true. However, the switch structure in PHP executes the block where the condition is true and the rest of the blocks below that. This is a weakness. The switch structure should execute only one block where the condition is true. To solve this problem, use the break statement in every block. Try the following code that illustrates this:

<?php

 $hisVar = 100;

 switch($hisVar)
 {

 case 10:
 {
 echo 'Value is small', ' ';
 break;
 }
 case 100:
 {
 echo 'Value is medium', ' ';
 break;
 }
 case 1000:
 {
 echo 'Value is large', ' ';
 break;
 }
 default:
 {
 echo '$hisVar is very large', ' ';
 }
 }

?>

The output is:

 Value is medium

as required.

Always use the break statement at the end of each block of your switch structure.

With the switch structure, the comparison of a condition is loose. Loose comparison is when you use, == and !=. Strict comparison is when you use === and !==. To solve this problem, use the switch structure when strict comparison does not matter (i.e. when only both values matter and both types do not matter).

That is it for this part of the series. We stop here and continue in the next part.

Chrys

Cousins

BACK NEXT

Broad Network

Series Articles

PHP Switch Structure and Security Consideration

PHP Control Structures with Security Considerations - Part 3

Introduction

Related Links

Cousins

Comments