Question

I’m currently programming a website (in PHP4). I plan to save values, which do not change during runtime, in constants. Those are for example the version number of login-data for the database.

Question 1: are there any (security relevant) problems that can arise from saving data in constants?

At the moment I do the following to define and call the constant:

define("VERSION",   "1.0");
echo "Current version: ".VERSION."."; // Result: "Current version: 1.0."

There is one thing that annoys me: In case a constant is not defined, the “wrong” variable name is returned instead of e.g. NULL.

define("VERSION",   "1.0");
echo "Current version: ".VERSIONXXX."."; // Result: "Current version: VERSIONXXX."

One solution I found to get an error message and the return value “NULL” when I accidently entered a wrong constant name is using the function constant():

define("VERSION",   "1.0");
echo "Current version: ".constant("VERSIONXXX")."."; // Result: "Current version: ."

Question 2: Can I prevent in a different way, that PHP returns the name of the non-existing variable?

Question 3: Should the value of a constant in PHP always be returned using the function constant()?

Answer 1

In reverse Order:

Question 3: No
Question 2: Not really, but you can make adjustments.

because of (Question 1:) error_reporting. You PHP webserver is configured hide some errors. If you add

error_reporting(E_ALL);

to your scripts head, you will get a

Use of undefined constant MY_CONST – assumed ‘MY_CONST’

Error. Unfortunately it’s a problem coming out of PHP’s long history, that constants can be interpreted as strings.

If you can not be shure a constant was set in the first place you can use defined

if(defined('MY_CONSTANT') {
     //do something
}

But my personal opinion there shouldn’t be many cases to need this, since the word constant alone implies a garanteed presence. The only exception I can think of is the typical header test.

if(!defined('MY_APP_IS_PRESENT')) {
    die('You can not call this file on its own, please use index.php.');
}

And one last tipp: Go and make yourself a errorhandler function, maybe even with firephp?