strpos(): Argument #2 ($needle) must be of type string, array given

Question

I have this code:

if ( strpos( $_GET[ 'y' ], array( '/', '.', '\\', '%', '#', ';' ) ) === false

it worked fine on php5 but now on php 8 I get this error:

 strpos(): Argument #2 ($needle) must be of type string, array given

Do I have to get rid of that line altogether or is there any alternative fix out there?

What are you trying to achieve? [strpos](https://www.php.net/manual/en/function.strpos.php) expects strings for both the first and second parameters. — aynber, Apr 21 '23 at 18:12
I didnt write the script but seems like this is supposed to find out if any of the values in the array is present in the string. — Cain Nuke, Apr 21 '23 at 18:14
It didn't WORK in PHP 5, it just didn't generate an error until 5.3.1 https://3v4l.org/aVheZ — AbraCadaver, Apr 21 '23 at 18:25
it did work because on php 8 you get a fatal error which didnt happen back on php 5. — Cain Nuke, Apr 22 '23 at 06:36
@CainNuke It always failed, the behavior of failure just changed. As link shows even back in PHP 4 it didn't match. — user3783243, Apr 24 '23 at 18:01

score 1 · Answer 1 · answered Apr 21 '23 at 18:17

1

If you read the documentation https://www.php.net/manual/en/function.strpos.php you can see that both params need to be strings (as the error actually tells you).

If you wanna search for multiple stings either use a regular expression with

preg_match()

Or search online for strpos with multiple needles. It's even answered here in stack overflow strpos() with multiple needles? or here Using 2 or more needles when using strpos

Hope this helps ;)

answered Apr 21 '23 at 18:17

Ext

I tried preg_match like this: `preg_match('/\/|\.|\\\\|\%|\#|\;/i', $_GET[ 'y' ])` I got no error so far but Im not sure if this is what you mean. – Cain Nuke Apr 21 '23 at 18:23
I think you need something like this: if ( preg_match('/[\/\.\\%#;]/i', $_GET['y']) ) { echo 'Yes'; } else { echo 'No'; } – Ext Apr 21 '23 at 18:32
@CainNuke `/\/|\.|\\\\|\%|\#|\;/` is the same as `![/.\\\\%#;]!`. No need for `i` modifier, and change the delimiter so you don't need to escape it. – user3783243 Apr 21 '23 at 18:51
Are you sure? I cant make that one work here https://regexr.com/ – Cain Nuke Apr 21 '23 at 18:57
@CainNuke https://regex101.com/r/zjihoc/1 there's a regex demo. Not sure what `$_GET[ 'y' ]` has so can't test it – user3783243 Apr 21 '23 at 20:21

1 Answers1