PHP Bugs #21 to #30 — Common Mistakes Every PHP Developer Must Know published

From strlen() counting bytes wrong to PDO silent failures — 10 real PHP bugs that break production projects. Learn what went wrong and how to fix it.

venerdì 19 giugno 2026 New tab

TL;DRAI

Part 3 covers PHP bugs #21–30: file upload RCE, SQL injection, XSS, multibyte corruption, and redirect vulnerabilities. For engineering teams: highlights non-obvious failures (headers don't halt, strlen() breaks UTF-8, filename checks bypass shell).

1,501 words~7 min read

If you've been following this series — Part 1 (Bugs #1–10) covered type juggling and variable scoping, Part 2 (Bugs #11–20) tackled form handling and session quirks — now Part 3 is where things get genuinely dangerous.

Bugs #21 to #30 aren't just annoying syntax mistakes. Some are active security vulnerabilities. A few will crash your server under load. Others silently corrupt data without throwing a single error.

Let's go through each one.

Bug #21 — strlen() Giving Wrong Count for Multibyte Text

// ❌ Wrong