Technical Note: =, == and ===

[vincevincevince]

Just a quick technical note for those cutting their teeth on PHP about the meaning of the 'equals' sign.

PHP uses between one and three equals signs to mean different things. Some languages use the same sign-count for all purposes and decide the meaning by context - PHP is not one of them.

One Equals Sign "="

This is an assignment. The expression on the left is set to the value of the expression on the right.

$a = 7;
print a;
//result is 7

A variation upon this is the 'concatenating assignment operator' and the related arithmetic assignment operators. These place a simple single-character operator before the equals sign and are equivalent to applying the left-hand side expression as the first argument to the operator.

Example:
. is the concatenation operator (joins two strings)
.= is the concatenating assignment operator

$a = "hello ";
$a .= "john";
print $a;
//result is "hello john"

Similar operators exist for arithmetic:
+= additive assignment operator (add to existing value)
-= (subtraction)
*= (multiplication)
/= (division)

$a = 8;
$a += 2;
print $a;
//result is 10

Two Equals Signs "==" / Equals Equals

This is a test of equivalence (equality). It is a logical function which determines whether the left hand side is logically equal to the right hand side. Note that this is a logical equality and not an actual equality.

$a = 3;
$b = 3;
if ($a == $b) print "Equal";

This is also true:

$a = 0;
$b = false;
if ($a == $b) print "Equal";

Notice that although false and 0 are not the same, in a logical context they evaluate as the same.

Three Equals Signs "===" / Equals Equals Equals

This tests for an exact equality (identity). The left and right hand side must match entirely.

This is false:

$a = 0;
$b = false;
if ($a === $b) print "Equal";

Only this is true:

$a = false;
$b = false;
if ($a === $b) print "Equal";

Common Mistakes

The most common mistake I see is using one equals sign to test for equivalence. This happens because the code looks and reads very logically:

$a = 3;
$b = 4;
if ($a = $b) print "Passed";

The above code will indeed print 'Passed'. That's because it was possible to set $a to the value of $b ($a = $b), and so the result is 'true' for success.

The other common mistake is with the use of strpos(), the function to return the character number where a substring occurs within a longer string. When the substring occurs at the beginning of the longer string, the function returns 0. If the substring cannot be found, the function returns false. Use of == to test for a string not found will fail because 0 == false. You must use ==== false in your test.

Final note

There are many other important aspects which I've not touched on here, however I hope that this will help out some of you who have found it almost impossible to search for help on this issue due to the = sign not being supported by major search engines or indeed the PHP.net website's onsite search.

With thanks to Habtom who spotted an early mistake!

[cameraman]

That's because it was possible to set $a to the value of $b ($a = $b), and so the result is 'true' for success.

Actually it's because the new value of $a is neither zero nor false.
Consider:
$a = true;
$b = false;
if($a = $b) echo "result is true";
else echo "new value is false";

$a = 5;
$b = 0;
if($a = $b) echo "result is true";
else echo "new value is zero";

[vincevincevince]

cameraman, you are exactly right, I must be thinking of another language. Either way - don't make the mistake of using = to test if things are equal to one another.

[joelgreen]

I've been able to workaround login form by injecting a cookie on some sites because programmers put == instead of ===
Just opened my browser, and added cookie with a value "true" (without quotes).
Script was checking (i think so) like this:
if ($admin_cookie == $_COOKIE['admin']) {
// Cookie validation passed code
// We made it without knowing the real security cookie value :)
}
else {
// Cookie check failed code
}

So using === is a must where applicable