Skip to content
OpenAdvisories

Weakness (CWE)

CWE-597: Use of Wrong Operator in String Comparison

Variant Draft

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

How to prevent it (1 mitigation)

  1. Implementation

    Within Java, use .equals() to compare string values.

    Within JavaScript, use == to compare string values.

    Within PHP, use == to compare a numeric value to a string value. (PHP converts the string to a number.)

Source: MITRE CWE-597

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.0
    CVE-2021-4259

    phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison

    A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string com…

  • Medium 5.9
    CVE-2022-36072

    SilverwareGames.io used == for hashing instead of ===

    SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the `0e` symbols were being handled as zero multiplied with t…

    mesosoi silverwaregames-io-issue-tracker
  • Medium 4.8
    CVE-2021-3797

    Use of Wrong Operator in String Comparison in hestiacp/hestiacp

    hestiacp is vulnerable to Use of Wrong Operator in String Comparison

    hestiacp hestiacp/hestiacp