luads/php-xbase

Dangerous number_format with implicit parameters

Closed this issue · 0 comments

zbohm commented

https://github.com/hisamu/php-xbase/blob/26ceae6c7ca67d67132b5c1108e5e2906343631d/src/XBase/Record.php#L449

Function number_format without defined parameters dec_point and thousands_sep does not work properly for DBF number, because these parameters are taken from locales. Fof example thousand separator can ba a space, so it generate format such this: "1 000". And this value is not valid.

A correct call must be: number_format($value, $columnObj->getDecimalCount(), '.', '')