What are type-juggling vulnerabilities in PHP 7 and how do you prevent them?

Summary

In PHP 7, loose comparison (==) converts types unpredictably: '0e123' == '0e456' is true (both read as 0 in scientific notation) and 0 == 'abc' is true. This enables authentication bypasses with 'magic hashes'. Always use === and hash_equals().

Longer Answer

Classic bug: if (md5($input) == $storedHash), where both hashes start with 0e followed by digits, so they compare equal as floats (0). Also in_array, array_search and switch use loose comparison by default. Use strict comparison, strict flags and timing-safe hash_equals() for secrets.

Key Points

• '0e1' == '0e2' is true (numeric strings)
• 0 == 'abc' true in PHP 7
• Use ===, in_array(..., true)
• hash_equals() for token comparison