domains / families / security / type-juggling

type-juggling

separate

PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.

When to use

• PHP type juggling
• weak comparison (`==`) bypass
• authentication bypass
• HMAC/signature checks
• token validation
• loose equality
• numeric coercion
• hash comparisons without strict types

When not to use

• code using `hash_equals`
• code using `===`

Skill page

Source