PHP 4 to PHP 5 - isset checks on boolean if statements

Question

Scenario: We are in the process of converting an application from PHP 4 to PHP 5. The application needs to be able to work on PHP 4 for a little while, which means no PHP 5 specific elements can be used, yet. We are simply trying to make sure the application works on both platforms.

There are a lot of conditionals that look like this in the application:

if ($variable) { // do something }

Some of these variables end up not being defined at all and we are trying to reduce the number of errors (there's a lot of them).

To solve these errors, we are adding checks in various areas like this:

if (!isset($variable)) $variable = "";

or

if (!empty($variable)) { // do something }

Question: Does anyone know of a simpler approach to fixing these errors. The problem is that these variables are being used across files (via includes) and defining the variable may change the logical flow in that file if its doing a check like (if (!isset($variable)) { // do something }).

The point of this question is to reduce errors and time consumption of tracking each individual use of these variables. Currently, we are having to either examine thoroughly what the variable is doing (which may take a good chunk of time), or we are doing a "fire and forget" / hope-its-fixed method of correcting.

-- Edit -- Does anyone know of a program like cppcheck for php that could somehow reference these variables or create some kind of chaining that could find errors and link possible references? (I hope that makes sense.)

Answer 1

AFAIK there is a code-checker that looks for uninitialized variables which works OK. You can work through it's messages, it's called PHP Mess Detector and one of it's rule covers uninitialized variables. However this can never be perfect.

Another method is to track the error messages and use them to locate the places within in the code. I've done that in the past and it worked very well, just do it in iterations and keep log of the warnings.

You can also work with a whitelist and import whitelisted variables when the request starts. Non-whitelisted submissions need to cause an access violation error to have this properly working, so this way is more work than tracking warnings albeit it might make your application more secure.

Please see as well:

• PHP Syntax checking pre-source control
• E_NOTICE ?== E_DEBUG, avoiding isset() and @ with more sophisticated error_handler
• isset() and empty() make code ugly