There is a misunderstanding in character judgment by strpos function in PHP_PHP Tutorial

In php, strpos is the position where the string first appears. If it exists, it will return true or related specific numbers. If not, it will return 0 or false. But I want to use it to make a wordpress keyword blacklist to anti-spam comments. Found some problems, let's take a look below.

Modify the theme comments-ajax.php file

In the comments-ajax.php file in the theme directory, it is about line 60 (just get the $_POST['author'] and other fields in the comment form submitted by the user). Then add the following code to the file:

4 Postscript

Through the above simple code, we have realized the verification of the keywords in the blacklist by submitting the user nickname and comment content entered in the comment. Once any of the above words is matched, for example, www appears, the user will be prompted "The advertisement must be deleted, thank you for your understanding!" The effect is as shown in the figure below. This is another insurance for the blog, which enhances the immunity of WordPress against spam comments, and it is also achieved through a non-plugin method!

The above looks fine, but this morning @Bad Children’s Shoes did an evil test and discovered a bug in the code of the previous article. When I came back from get off work in the evening, I looked at the code carefully and found that I had a one-sided understanding of the strpos function, so I made a note to mark it.

2 Prototype of strpos function

I believe everyone is familiar with the strpos function, and it can often be seen in string processing. The strpos function prototype is:

/*
* @Para string $source: Search in this string [*]
* @Para mixed $target: The string to be found; if it is not a string, it will be converted to an integer and regarded as the sequential value of characters [*]
* @Para int $offset: starting position of search
* @Return int/boolean: If successful, return the position of the first occurrence; if failed, return FALSE value
​ **/
int strpos(string $source, mixed $target [, int $offset = 0 ]);
 

3 Simple test of strpos function

After understanding the prototype of the strpos function, let’s first look at a simple test code.

The test results are shown below:

Re-discuss WordPress anti-spam comments: It’s all the fault of the strpos function

4 Analysis of test results of strpos function

There are two different test variables $test_1 and $test_2 in the above code, and both of them contain the keywords in the blacklist: purchase. However, judging from the test results shown in the figure, the $test_1 variable is not effectively blocked, while the variable $test_2 is prompted to contain advertising words. The secret lies in the position where the word "purchase" appears in variables $test_1 and $test_2! When the keyword "purchase" appears at the front ($test_1), the execution result of the strpos($test_1,$word[$i],0) function is 0, because the word "purchase" is in the string "purchase TT" The front. Then the if statement in the for loop becomes if(0){}, so that it will not be regarded as a spam comment, which causes a BUG. The following are two methods to implement "wordpress keyword blacklist: anti-spam comment upgrade" by continuing to use the strpos function and using PHP regular expressions.
5.1 Correctly use strpos function to fix BUG

6 Important reminders about function strpos

Another thing to note when using the strpos function is that it may return a Boolean value of FALSE, but it may also return a non-Boolean value equivalent to FALSE.
For example, return integer type 0, floating point value 0.0, empty string, string "0", array not including any elements, object not including any member variables, special type NULL, etc.
Therefore, the return value of this function should be tested using the identity operator "===" which checks the type of the returned value, rather than using the simple equal sign "==".

7Update 2013.09.26 22:27

After being reminded by @星河大帝, you can use an array instead of a string, and the execution efficiency should be about the same.
7.1 Use strpos function + array to fix BUG

7.2 Use regular expressions + arrays to fix BUG