php/php-src — pull request #527 by TazeTSchnitzel (2013-11-11 19:01:50+00:00)
Title: Fixed case part of bug #64874 ("json_decode handles whitespace and case-sensitivity incorrectly")

This request fixes the JSON parser's handling of top-level true/false/null. By that I mean a lone true/false/null value, not one inside an array of object. Hence, `json_decode("True");` (currently valid) is affected but `json_decode("[True]");` (currently invalid) is not.

At present, there is a bug where non-lowercase forms (e.g. `True` or `tRUE`) of these top-level values are accepted by the parser without erroring. This behaviour is not compliant with the JSON.org standard, nor the IETF RFC, nor the ECMA standard. It is also inconsistent with other JSON implementations. Were I to try `JSON.parse('True');` in JavaScript or `json.loads('true')` in Python, I would be met with an error. The function is even inconsistent with itself in this respect, as `[True]` will fail but `True` will not. I suspect that this behaviour was not intended and simply came about because of someone failing to read the specification and assuming case-insensitivity.

Hence I propose this patch. It replaces `strcasecmp` with `strcmp` where the former was used incorrectly. It is a minor backwards-compatibility break, so I am targeting this at 5.6. However I believe that it is very unlikely that any code relied on this bug, since all JSON serialisers output lowercase literals, and any hand-written JSON is likely not a lone true, false or null value.

In the event that code relied on this bug, they could simply do something like this:

```php
function json_decode_bad($json) {
$json = trim($json, ' \t\n\r');
$values = ['true' => true, 'false' => false, 'null' => null];
foreach ($values as $key => $value) {
if (strcasecmp($key, $json) === 0) {
return $value;
}
}
return json_decode($json);
}
```

So, I ask that this is merged, as a tiny backwards-compatibility break but bringing PHP into harmony with other JSON implementations and the specification.