"date" sanitizer failing on Feb 31

[tpr]

I just noticed these outputs:

echo wire('sanitizer')->date('2017/02/27'); // 1488153600
echo wire('sanitizer')->date('2017/02/31'); // 1488499200 - FAIL
echo wire('sanitizer')->date('2017/02/32'); // NULL

Shouldn't the sanitizer return NULL on the second line? If it were looking for a valid date format only then the third line should return a timestamp too.

[LostKobrakai]

From the php docs:

Quote

Dates in the m/d/y or d-m-y formats are disambiguated by looking at the separator between the various components: if the separator is a slash (/), then the American m/d/y is assumed; whereas if the separator is a dash (-) or a dot (.), then the European d-m-y format is assumed. If, however, the year is given in a two digit format and the separator is a dash (-, the date string is parsed as y-m-d.

If you really want to be sure about date parsing you'd need to specify the format otherwise you'll always find issues.

[tpr]

Thanks, but even the format supplied the date is not null:

echo wire('sanitizer')->date('2017/02/31', 'Y/m/d'); // 2017/03/03
echo wire('sanitizer')->date('2017-02-31', 'Y-m-d'); // 2017/03/03

 

[LostKobrakai]

Ok, I'm not sure why, but it seems like the format is not used in Sanitizer::date, which defeats the purpose of the WireDateTime class which is supposed to be more intelligent than strtotime.

[Robin S]

Looks like internally $sanitizer->date() is relying on strtotime() to check that the date is valid, and this function for some reason returns a timestamp for '2017/02/31' rather than 'false'.  It should perhaps be changed to checkdate() which correctly identifies that date as invalid.

In the meantime you could add an extra validation:

function validate_date($value) {
    $parsed = date_parse($value);
    return checkdate($parsed['month'], $parsed['day'], $parsed['year']);
}

 

[tpr]

Thanks guys - should I add a github issue?

[LostKobrakai]

Probably. I mean we do already have WireDatetime, which should be able to handle those cases and the $format in the sanitizer seems like ryan wanted to use it.