CWE-597
Use of Wrong Operator in String Comparison
AI Translation Available
The product uses the wrong operator when comparing a string, such as using '==' when the .equals() method should be used instead.
Status
draft
Abstraction
variant
Affected Platforms
Java
JavaScript
Not Language-Specific
PHP
Extended Description
AI Translation
In Java, using == or != to compare two strings for equality actually compares two objects for equality rather than their string values for equality. Chances are good that the two references will never be equal. While this weakness often only affects program correctness, if the equality is used for a security decision, the unintended comparison result could be leveraged to affect program security.
Technical Details
AI Translation
Common Consequences
other
Impacts
other
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Within Java, use .equals() to compare string values.
Within JavaScript, use == to compare string values.
Within PHP, use == to compare a numeric value to a string value. (PHP converts the string to a number.)