The whitespace of death

As the first entry to the list of my PHP-related WTFs, I present:

The whitespace of death

This one has taken me almost a full hour to sort out. There may be some good features to PHP, yet this one I don’t think is even one. It should be considered a bug. As my experience has grown in reporting bugs myself or trying to report a bug, I reconsidered and chose not to report it as a “bug”.

The whitespace of death

Once a customer reported to us, that a crucial PHP function (namely imagecolorallocate()) was “missing” from one of our shared hosting servers. It was, in fact, not. We made sure, that for all versions of PHP available on our systems, phpinfo() would say that gd2 was in fact loaded and provided its basic functions.

I went on to take a look at the customer’s script and found nothing suspicious. It looked sort of like this:

80
81
82
// code before
$color = imagecolorallocate($img, 0xFF, 0x00, 0x00);
// code after

When executing the script, the following error message came up:

Fatal error: Call to undefined function imagecolorallocate() on line 81

I tried to reproduce and by typing it manually, wrote a script with the exact same code. It ran. As it was supposed to. I took the customer’s script and deleted everything before and after the culprit. Did the same with the duplicate script. I added the following at the start:

1
2
3
4
<?php
header('Content-Type: text/plain');
// ....
?>

I saw, that the error message actually said:

Fatal error: Call to undefined function  imagecolorallocate() on line 81

There’s two spaces between function and imagecolorallocate(). One too many. One of them (the first) is 0x20. The second was 0xA0.

It turned out, the customer copy-pasted an example found somewhere on the internet from his/her browser into the script. The example code was automagically formatted using PHP’s built-in function highlight_string(). That one turns any white space to a non-breaking whitespace (better known as &nbsp;, or character code 0xA0). Which is considered legal input for identifiers by PHP.

An example can be downloaded here: ghost.php.

Here’s what TortoiseSVN said when comparing both files:


This post has been purposefully tagged as a rant. I think the PHP team’s attempt to make the thing be usable by anyone without any mentionable programming background has gone too far. The intent was (guessing here) to enable German programmers the use of so called Denglish in their code without regret:

$breite = 320;         // width
$höhe = 200;           // height
if ($höhe > $breite)
   $hochkant = TRUE;   // landscape
else
   $hochkant = FALSE;

I have actually seen this kind of code. Reproducing it here makes me want to puke, actually.

WTF.

Leave a Reply

Your email address will not be published. Required fields are marked *