CWE-597: Use of Wrong Operator in String Comparison

Description

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

Potential Impact

Other: Other

How to Fix

Implementation

Within Java, use .equals() to compare string values. Within JavaScript, use == to compare string values. Within PHP, use == to compare a numeric value to a string value. (PHP converts the string to a number.)

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-597 vulnerabilities in your codebase.

Get Security Assessment